# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.2.79
description:
2025-01-28 11:41:01 dovecot_plain authenticator failed for (j8makiutqzpa1vif5pjszerh2fv2) [77.40.2.79]:18627: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:40:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.252.7
description:
Jan 28 11:41:31 ait sshd[3590472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.252.7  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.151
description:
2025-01-28 11:41:01 dovecot_plain authenticator failed for (x59w80qs8mm8kvxm72o8m5emzsa) [77.40.62.151]:15915: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.150.131
description:
[2025-01-28 11:42:28 +0100] info [webmaild] 45.224.150.131 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:42:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.2.79
description:
Jan 28 11:42:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.2.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.151
description:
Jan 28 11:42:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.2.79
description:
2025-01-28 11:42:43 dovecot_plain authenticator failed for (8euo0s65ab69s9lxem31bvxc9pw) [77.40.2.79]:18245: 535 Incorrect authentication data (set_id=eng19a00082y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.158.241.204
description:
[2025-01-28 11:42:03 +0100] info [webmaild] 105.158.241.204 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.151
description:
2025-01-28 11:42:43 dovecot_plain authenticator failed for (sq6e5q3j8urvy2ho4ima) [77.40.62.151]:14958: 535 Incorrect authentication data (set_id=ads20a00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.232.152
description:
Jan 28 11:43:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.232.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.65.117
description:
2025-01-28 11:43:23 dovecot_login authenticator failed for ([183.238.65.117]) [183.238.65.117]:50981: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.86.60.248
description:
2025-01-28 11:43:27 dovecot_login authenticator failed for (60.86.172.in-addr.arpa) [172.86.60.248]:50348: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.222.84
description:
Jan 28 11:43:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.222.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.222.84
description:
2025-01-28 11:43:45 dovecot_login authenticator failed for ([183.234.222.84]) [183.234.222.84]:60253: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
description:
2025-01-28 11:43:21 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:46819: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.232.152
description:
2025-01-28 11:43:34 dovecot_login authenticator failed for ([104.241.232.152]) [104.241.232.152]:38382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:43:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
description:
Jan 28 11:43:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.65.117
description:
Jan 28 11:43:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.65.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.86.60.248
description:
Jan 28 11:43:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.86.60.248 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.252.7
description:
Jan 28 11:43:56 ait sshd[3591898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.252.7  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 28 11:44:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-28 11:44:05 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:42256: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-28 11:45:37 dovecot_login authenticator failed for ([120.71.199.46]) [120.71.199.46]:55896: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.113
description:
2025-01-28 11:45:05 dovecot_plain authenticator failed for (7tz928xdheqsqefuxkynx) [77.40.62.113]:5025: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 28 11:45:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-28 11:45:23 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:53610: 535 Incorrect authentication data (set_id=sales@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Jan 28 11:45:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.113
description:
Jan 28 11:45:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 28 11:45:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 28 11:45:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.241.161
description:
Jan 28 11:46:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.195.38
description:
Jan 28 11:46:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.195.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
description:
Jan 28 11:46:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-01-28 11:46:10 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:53953: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.241.161
description:
2025-01-28 11:46:32 dovecot_login authenticator failed for p54161-obmd01.osaka.ocn.ne.jp [153.141.241.161]:55219: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.228
description:
Jan 28 11:46:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.228
description:
2025-01-28 11:46:37 dovecot_login authenticator failed for ([114.108.126.228]) [114.108.126.228]:53052: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-28 11:47:40 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:49464: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-28 11:47:48 dovecot_login authenticator failed for ([116.90.97.209]) [116.90.97.209]:35609: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.113
description:
Jan 28 11:46:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.136.252
description:
[2025-01-28 11:47:11 +0100] info [webmaild] 45.228.136.252 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 28 11:47:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.145.233
description:
2025-01-28 11:47:28 dovecot_login authenticator failed for ([110.49.145.233]) [110.49.145.233]:36384: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 28 11:47:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.113
description:
2025-01-28 11:46:57 dovecot_plain authenticator failed for (5bvndc1c5jwn90h9lkop) [77.40.62.113]:18171: 535 Incorrect authentication data (set_id=eng19a00082y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.107.0.188
description:
Jan 28 11:47:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.107.0.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.107.0.188
description:
2025-01-28 11:47:07 dovecot_login authenticator failed for ([218.107.0.188]) [218.107.0.188]:58597: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 28 11:47:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-28 11:47:38 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:35997: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Jan 28 11:47:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.39.117.146
description:
[2025-01-28 11:47:46 +0100] info [webmaild] 212.39.117.146 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.49.145.233
description:
Jan 28 11:47:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.49.145.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-28 11:47:28 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:52871: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 28 11:47:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-01-28 11:47:40 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:36884: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 11:47:54 ait sshd[3595008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.135.193
description:
[2025-01-28 11:47:55 +0100] info [webmaild] 157.100.135.193 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.147.171.132
description:
[2025-01-28 11:47:57 +0100] info [webmaild] 197.147.171.132 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
description:
Jan 28 11:48:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 28 11:48:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
description:
2025-01-28 11:48:31 dovecot_login authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:57964: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
description:
2025-01-28 11:48:41 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:47350: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.253
description:
Jan 28 11:47:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-28 11:48:32 dovecot_login authenticator failed for ([58.216.101.162]) [58.216.101.162]:51666: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-01-28 11:48:39 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:54718: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
description:
Jan 28 11:48:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.253
description:
2025-01-28 11:47:59 dovecot_login authenticator failed for ([112.102.48.253]) [112.102.48.253]:41652: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Jan 28 11:48:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-01-28 11:48:18 dovecot_login authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:43166: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.179.9
description:
[2025-01-28 11:48:23 +0100] info [webmaild] 45.173.179.9 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
description:
2025-01-28 11:48:28 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:65101: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
description:
Jan 28 11:48:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.186.253.77
description:
[2025-01-28 11:48:42 +0100] info [webmaild] 91.186.253.77 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 11:47:54 ait sshd[3595008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.71.195
description:
Jan 28 11:48:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.71.195
description:
2025-01-28 11:48:20 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.71.195]:42640: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Jan 28 11:48:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.224.134
description:
[2025-01-28 11:48:57 +0100] info [webmaild] 37.40.224.134 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 28 11:49:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.138
description:
Jan 28 11:49:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 28 11:49:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Jan 28 11:48:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-01-28 11:49:49 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:41184: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Jan 28 11:49:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.223.168.193
description:
Jan 28 11:49:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.223.168.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
description:
Jan 28 11:49:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:49:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.5.148
description:
[2025-01-28 11:49:40 +0100] info [webmaild] 179.108.5.148 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-28 11:49:46 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:50422: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-01-28 11:49:01 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:36095: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.210.49
description:
Jan 28 11:49:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.210.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-28 11:49:31 dovecot_login authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:49630: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.180.120
description:
2025-01-28 11:49:32 dovecot_login authenticator failed for ([180.7.180.120]) [180.7.180.120]:46863: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:49:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.230
description:
Jan 28 11:49:45 ait sshd[3595919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 28 11:48:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-28 11:48:54 dovecot_login authenticator failed for ([41.93.113.138]) [41.93.113.138]:36816: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
description:
Jan 28 11:49:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-28 11:49:19 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:35362: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-01-28 11:49:20 dovecot_login authenticator failed for ([185.129.114.190]) [185.129.114.190]:49078: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.180.120
description:
Jan 28 11:49:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.180.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
description:
2025-01-28 11:49:32 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:40701: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.138
description:
2025-01-28 11:49:22 dovecot_plain authenticator failed for ([112.91.124.138]) [112.91.124.138]:38377: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.228.112.97
description:
[2025-01-28 11:49:36 +0100] info [webmaild] 88.228.112.97 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.230
description:
Jan 28 11:49:45 ait sshd[3595919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.230  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Jan 28 11:49:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-28 11:49:02 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:40794: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.210.49
description:
2025-01-28 11:49:11 dovecot_plain authenticator failed for (abts-kk-static-49.210.166.122.airtelbroadband.in) [122.166.210.49]:38474: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.42.130.106
description:
[2025-01-28 11:49:29 +0100] info [webmaild] 176.42.130.106 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.47.43
description:
2025-01-28 11:50:20 dovecot_login authenticator failed for ([117.192.47.43]) [117.192.47.43]:47963: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-28 11:50:31 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:39289: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-01-28 11:50:05 dovecot_login authenticator failed for ([103.177.40.85]) [103.177.40.85]:38053: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.20.8.25
description:
Jan 28 11:50:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.20.8.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.219.254
description:
Jan 28 11:49:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.219.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.111
description:
Jan 28 11:49:52 ait sshd[3596093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 28 11:49:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.230
description:
Jan 28 11:49:58 ait sshd[3596143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.230  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Jan 28 11:50:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.67.1
description:
2025-01-28 11:50:05 dovecot_login authenticator failed for (wtl.worldcall.net.pk) [111.88.67.1]:54918: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.249.165
description:
Jan 28 11:50:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.249.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:50:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Jan 28 11:50:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.111
description:
Jan 28 11:49:52 ait sshd[3596093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.219.254
description:
2025-01-28 11:49:53 dovecot_login authenticator failed for ([124.115.219.254]) [124.115.219.254]:57314: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 28 11:49:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.197.201
description:
Jan 28 11:50:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.197.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.244
description:
2025-01-28 11:50:08 dovecot_login authenticator failed for ([123.214.65.244]) [123.214.65.244]:44318: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.20.8.25
description:
2025-01-28 11:50:14 dovecot_login authenticator failed for ([5.20.8.25]) [5.20.8.25]:49140: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.230
description:
Jan 28 11:49:52 ait sshd[3595919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-28 11:50:01 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:58110: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.197.201
description:
2025-01-28 11:50:06 dovecot_login authenticator failed for ([120.82.197.201]) [120.82.197.201]:50946: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:50:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.41.120
description:
Jan 28 11:50:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.41.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.41.120
description:
2025-01-28 11:50:40 dovecot_login authenticator failed for ([185.181.41.120]) [185.181.41.120]:45795: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.244
description:
Jan 28 11:50:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-01-28 11:50:06 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:44479: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.34.84
description:
Jan 28 11:50:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-01-28 11:50:32 dovecot_login authenticator failed for ([101.231.247.210]) [101.231.247.210]:57515: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 28 11:50:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-28 11:49:58 dovecot_login authenticator failed for ([102.221.64.10]) [102.221.64.10]:60126: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
description:
2025-01-28 11:50:16 dovecot_login authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:55064: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.47.43
description:
Jan 28 11:50:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.47.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.249.165
description:
2025-01-28 11:50:22 dovecot_login authenticator failed for ([220.180.249.165]) [220.180.249.165]:60547: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:50:46 dovecot_plain authenticator failed for (f3lc9lc7g3dt4cjrfi3kb2kx) [77.40.3.38]:15719: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:50:54 dovecot_plain authenticator failed for (84v0eet9ma3qebks1m68geldo5) [77.40.3.38]:19246: 535 Incorrect authentication data (set_id=ads20a00036y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.180.143
description:
2025-01-28 11:51:38 dovecot_plain authenticator failed for ([180.7.180.143]) [180.7.180.143]:35133: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
description:
2025-01-28 11:51:50 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:53820: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.180.143
description:
Jan 28 11:51:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.180.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 28 11:51:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.225
description:
Jan 28 11:51:41 ait sshd[3597388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.225  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Jan 28 11:50:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-01-28 11:50:57 dovecot_login authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:59877: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 28 11:51:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.185.156.38
description:
[2025-01-28 11:51:31 +0100] info [webmaild] 46.185.156.38 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
description:
Jan 28 11:51:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-28 11:51:40 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:30751: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.225
description:
Jan 28 11:51:41 ait sshd[3597388]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:50:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.75
description:
[2025-01-28 11:51:37 +0100] info [webmaild] 84.54.72.75 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.246.114
description:
2025-01-28 11:52:35 dovecot_login authenticator failed for ([120.237.246.114]) [120.237.246.114]:52054: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.66.228
description:
[2025-01-28 11:52:36 +0100] info [webmaild] 37.77.66.228 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
description:
Jan 28 11:52:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.246.118.115
description:
Jan 28 11:52:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.246.118.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.83.38.15
description:
Jan 28 11:52:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.83.38.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:52:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:52:42 dovecot_plain authenticator failed for (sfgd19l1u2xzq1uh6oxadkt2p5qiu) [77.40.3.38]:10915: 535 Incorrect authentication data (set_id=eng19a00082y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.214.226
description:
2025-01-28 11:52:46 dovecot_login authenticator failed for (broadband.actcorp.in) [115.245.214.226]:42930: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 28 11:51:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.11.218
description:
Jan 28 11:52:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.11.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.227
description:
Jan 28 11:52:39 ait sshd[3597883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.227  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Jan 28 11:52:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Jan 28 11:51:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-28 11:52:01 dovecot_login authenticator failed for ([37.224.119.19]) [37.224.119.19]:46112: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 28 11:52:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
description:
Jan 28 11:52:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:52:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 28 11:51:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-28 11:51:54 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:59733: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.225
description:
Jan 28 11:51:54 ait sshd[3597577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.225  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.246.114
description:
Jan 28 11:52:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.246.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-01-28 11:52:34 dovecot_login authenticator failed for ([211.252.168.97]) [211.252.168.97]:55732: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.227
description:
Jan 28 11:52:39 ait sshd[3597883]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.225
description:
Jan 28 11:51:54 ait sshd[3597577]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
description:
2025-01-28 11:52:29 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:59174: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.11.218
description:
2025-01-28 11:52:06 dovecot_login authenticator failed for ([187.51.11.218]) [187.51.11.218]:43926: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.83.38.15
description:
2025-01-28 11:52:21 dovecot_login authenticator failed for (50-83-38-15.client.mchsi.com) [50.83.38.15]:43680: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-01-28 11:52:18 dovecot_login authenticator failed for ([179.51.0.170]) [179.51.0.170]:47451: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.225.215.93
description:
[2025-01-28 11:52:21 +0100] info [webmaild] 91.225.215.93 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 11:52:22 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:33556: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
description:
Jan 28 11:52:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-01-28 11:52:01 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:44534: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.246.118.115
description:
2025-01-28 11:52:17 dovecot_plain authenticator failed for nz118l115.bb60246.ctm.net [60.246.118.115]:58264: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:53:08 dovecot_plain authenticator failed for (40fj92qqe573ckot23) [77.40.3.38]:11907: 535 Incorrect authentication data (set_id=ads20a00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.113.91.98
description:
Jan 28 11:53:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.113.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-28 11:53:37 dovecot_login authenticator failed for ([211.109.75.68]) [211.109.75.69]:51580: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.63.189
description:
Jan 28 11:53:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.63.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:53:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 28 11:53:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.113.91.98
description:
2025-01-28 11:53:23 dovecot_login authenticator failed for ([223.113.91.98]) [223.113.91.98]:34144: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 28 11:55:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-28 11:55:39 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:35581: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
description:
Jan 28 11:54:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.0.69.202
description:
Jan 28 11:55:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.0.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.0.69.202
description:
2025-01-28 11:55:28 dovecot_login authenticator failed for 191-0-69-202.host.telemar.net.br (18980159097.user.veloxzone.com.br) [191.0.69.202]:48671: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 28 11:57:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-28 11:57:40 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:51496: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.219.157
description:
Jan 28 11:57:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.219.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Jan 28 11:57:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
description:
Jan 28 11:58:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 11:58:45 ait sshd[3601259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 11:58:46 ait sshd[3601283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-01-28 11:58:00 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:1236: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 28 11:58:46 ait sshd[3601283]: Invalid user universitypublishing from 116.122.157.193 port 43598


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 11:58:46 ait sshd[3601283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.219.157
description:
2025-01-28 11:57:52 dovecot_login authenticator failed for ([94.205.219.157]) [94.205.219.157]:55973: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.249.2.222
description:
[2025-01-28 11:58:13 +0100] info [webmaild] 94.249.2.222 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
description:
2025-01-28 11:58:24 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:53491: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.151.189.218
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:adom-oduro@ait.edu.gh||WPU:adom-oduro@ait.edu.gh||RSV:6.65||T:APACHE||MV:11-57.193.151.189.218


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 11:58:45 ait sshd[3601259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.114.91
description:
[2025-01-28 11:59:26 +0100] info [webmaild] 213.230.114.91 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.39.66.140
description:
[2025-01-28 11:59:45 +0100] info [webmaild] 187.39.66.140 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.118.31
description:
[2025-01-28 11:59:48 +0100] info [webmaild] 213.230.118.31 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 11:59:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:59:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.139.83.133
description:
[2025-01-28 12:00:16 +0100] info [webmaild] 181.139.83.133 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.125.167.156
description:
[2025-01-28 12:00:24 +0100] info [webmaild] 188.125.167.156 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.251.134
description:
2025-01-28 12:00:36 H=(mail.iric.us) [165.154.251.134]:59610 F=<xffcwm@iric.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.119.81
description:
[2025-01-28 12:01:07 +0100] info [webmaild] 191.5.119.81 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.11.252
description:
[2025-01-28 12:01:15 +0100] info [webmaild] 102.0.11.252 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.84.176
description:
[2025-01-28 12:01:16 +0100] info [webmaild] 143.137.84.176 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.30.223
description:
[2025-01-28 12:01:48 +0100] info [webmaild] 186.158.30.223 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.251.134
description:
2025-01-28 12:01:00 H=(mail.jaster.us) [165.154.251.134]:63982 F=<srgqqakmlvq@jaster.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.28.168
description:
Jan 28 12:01:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.227.28.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 12:02:42 ait sshd[3603401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 12:02:42 ait sshd[3603401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.28.168
description:
2025-01-28 12:01:57 dovecot_plain authenticator failed for ip212-227-28-168.pbiaas.com [212.227.28.168]:61888: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-28 12:03:21 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:36368: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 28 12:03:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
description:
Jan 28 12:03:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
description:
Jan 28 12:03:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
description:
2025-01-28 12:03:02 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:42264: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.18.86
description:
[2025-01-28 12:03:13 +0100] info [webmaild] 168.195.18.86 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
description:
2025-01-28 12:03:45 dovecot_login authenticator failed for ([111.61.177.189]) [111.61.177.189]:13506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.186.8
description:
Jan 28 12:03:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.186.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.186.8
description:
2025-01-28 12:03:12 dovecot_login authenticator failed for ([163.142.186.8]) [163.142.186.8]:43049: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 28 12:03:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.145.20.95
description:
[2025-01-28 12:03:22 +0100] info [webmaild] 177.145.20.95 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-28 12:03:25 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:53032: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.85.6
description:
[2025-01-28 12:03:36 +0100] info [webmaild] 45.181.85.6 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 28 12:03:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-28 12:03:44 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:30252: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-28 12:04:32 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:37700: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 12:03:56 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:53311: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 28 12:04:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 28 12:04:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 12:03:58 ait sshd[3604008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-28 12:03:58 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:36476: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.60.10.125
description:
[2025-01-28 12:04:21 +0100] info [webmaild] 177.60.10.125 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 12:03:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 12:03:58 ait sshd[3604008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-28 12:04:49 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:39940: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 28 12:03:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 12:04:58 ait sshd[3604491]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
description:
2025-01-28 12:05:28 dovecot_plain authenticator failed for ([191.217.137.126]) [191.217.137.126]:34224: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.198
description:
Jan 28 12:05:50 ait sshd[3605450]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.198
description:
Jan 28 12:05:50 ait sshd[3605450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 12:04:58 ait sshd[3604491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
description:
Jan 28 12:05:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
description:
Jan 28 12:05:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
description:
2025-01-28 12:05:40 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:46729: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.233
description:
Jan 28 12:05:45 ait sshd[3605441]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.233
description:
Jan 28 12:05:45 ait sshd[3605441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.233  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.233
description:
Jan 28 12:05:58 ait sshd[3605490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.233  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.48.162.11
description:
[2025-01-28 12:05:59 +0100] info [webmaild] 103.48.162.11 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.198
description:
Jan 28 12:05:54 ait sshd[3605450]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.198
description:
Jan 28 12:06:03 ait sshd[3605527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.233
description:
Jan 28 12:05:53 ait sshd[3605441]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-28 12:08:18 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:54654: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 28 12:08:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Jan 28 12:07:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-01-28 12:07:56 dovecot_plain authenticator failed for ([201.172.170.49]) [201.172.170.49]:37687: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.92.33.198
description:
2025-01-28 12:08:02 dovecot_plain authenticator failed for syn-070-092-033-198.biz.spectrum.com [70.92.33.198]:46690: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.167.139
description:
Jan 28 12:08:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.167.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.167.139
description:
2025-01-28 12:08:16 dovecot_plain authenticator failed for (abts-kk-static-139.167.166.122.airtelbroadband.in) [122.166.167.139]:39386: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 28 12:08:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-28 12:08:49 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:9866: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.46.39
description:
47.128.46.39 - - [28/Jan/2025:12:07:54 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24538878 HTTP/1.1" 302 0 www.aitedu.us "http://www.aitedu.us/spcp/index.php?Itemid=103&option=com_content&view=archive" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.92.33.198
description:
Jan 28 12:08:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.92.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:08:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.58.190
description:
Jan 28 12:09:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.58.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Jan 28 12:09:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.58.190
description:
2025-01-28 12:09:11 dovecot_login authenticator failed for p165190-obmd01.tokyo.ocn.ne.jp [153.141.58.190]:41555: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
description:
2025-01-28 12:09:24 dovecot_login authenticator failed for ([65.76.106.187]) [65.76.106.187]:46800: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
description:
Jan 28 12:09:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
description:
Jan 28 12:09:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
description:
Jan 28 12:09:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Jan 28 12:09:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-01-28 12:09:23 dovecot_login authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:38636: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Jan 28 12:09:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-01-28 12:09:37 dovecot_login authenticator failed for ([115.75.188.242]) [115.75.188.242]:48704: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-28 12:09:38 dovecot_login authenticator failed for ([112.111.61.229]) [112.111.61.229]:43314: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.73
description:
2025-01-28 12:09:42 dovecot_login authenticator failed for ([183.204.41.73]) [183.204.41.73]:35590: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
description:
2025-01-28 12:09:48 dovecot_login authenticator failed for ([178.178.194.151]) [178.178.194.151]:47676: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-01-28 12:09:30 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:54695: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Jan 28 12:09:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
description:
2025-01-28 12:09:35 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (iness) [5.228.154.62]:33512: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 28 12:09:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.73
description:
Jan 28 12:09:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
description:
Jan 28 12:08:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
description:
2025-01-28 12:09:01 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:48094: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.31.93.141
description:
[2025-01-28 12:09:09 +0100] info [webmaild] 194.31.93.141 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-01-28 12:09:13 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:59166: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
description:
Jan 28 12:09:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.247.195
description:
2025-01-28 12:09:58 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:56340: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.247.195
description:
Jan 28 12:09:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.247.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.189.211.114
description:
Jan 28 12:09:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.189.211.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.25
description:
47.128.16.25 - - [28/Jan/2025:12:10:17 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23554344 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
description:
2025-01-28 12:09:51 dovecot_login authenticator failed for ([183.220.247.88]) [183.220.247.88]:34260: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
description:
2025-01-28 12:09:53 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:47664: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-01-28 12:10:05 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:34660: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 12:10:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-01-28 12:10:59 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:44634: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
description:
2025-01-28 12:11:09 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:44306: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.97.200.4
description:
[2025-01-28 12:11:19 +0100] info [webmaild] 102.97.200.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.158.42.151
description:
[2025-01-28 12:12:13 +0100] info [webmaild] 201.158.42.151 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:12:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.207.124
description:
[2025-01-28 12:11:52 +0100] info [webmaild] 45.177.207.124 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.178.30.21
description:
[2025-01-28 12:11:58 +0100] info [webmaild] 190.178.30.21 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.136.186.132
description:
[2025-01-28 12:12:10 +0100] info [webmaild] 178.136.186.132 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.201.255.96
description:
[2025-01-28 12:13:41 +0100] info [webmaild] 62.201.255.96 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-28 12:13:47 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:36660: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.43.62.74
description:
[2025-01-28 12:12:58 +0100] info [webmaild] 31.43.62.74 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.229.177.118
description:
[2025-01-28 12:13:00 +0100] info [webmaild] 196.229.177.118 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.220.96.139
description:
[2025-01-28 12:13:03 +0100] info [webmaild] 197.220.96.139 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 12:13:19 ait sshd[3609976]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 12:13:19 ait sshd[3609976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
description:
2025-01-28 12:13:48 dovecot_login authenticator failed for (17.54.gonzagatelecom.com.br) [177.128.54.17]:37008: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Jan 28 12:14:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 28 12:13:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.141.34.41
description:
[2025-01-28 12:14:49 +0100] info [webmaild] 200.141.34.41 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-01-28 12:14:34 dovecot_login authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:48649: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-01-28 12:13:55 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:53515: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-28 12:14:00 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:51382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.33.71
description:
47.128.33.71 - - [28/Jan/2025:12:14:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8920867 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/info.php?id=98" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Jan 28 12:13:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-01-28 12:14:14 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:45742: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.104.126
description:
[2025-01-28 12:15:04 +0100] info [webmaild] 157.100.104.126 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.255.159
description:
[2025-01-28 12:15:12 +0100] info [webmaild] 45.169.255.159 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-01-28 12:14:56 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:54622: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.144.175.201
description:
[2025-01-28 12:15:01 +0100] info [webmaild] 217.144.175.201 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-28 12:15:03 dovecot_plain authenticator failed for (unthypters) [65.20.205.197]:43639: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:15:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
description:
2025-01-28 12:15:10 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:33186: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
description:
2025-01-28 12:16:28 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:46211: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:16:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-01-28 12:16:38 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:44492: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.228
description:
Jan 28 12:16:07 ait sshd[3611640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.228  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.62.47.13
description:
[2025-01-28 12:16:47 +0100] info [webmaild] 189.62.47.13 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.228
description:
Jan 28 12:16:07 ait sshd[3611640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-01-28 12:17:39 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:56971: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
description:
2025-01-28 12:17:48 dovecot_plain authenticator failed for (becatra) [65.20.148.165]:50769: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.119.109
description:
[2025-01-28 12:17:49 +0100] info [webmaild] 128.201.119.109 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.77.197
description:
2025-01-28 12:17:27 dovecot_plain authenticator failed for 37.150.77.197.dynamic.telecom.kz [37.150.77.197]:58605: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Jan 28 12:17:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.165
description:
Jan 28 12:17:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-28 12:18:15 dovecot_plain authenticator failed for ([5.189.118.24]) [5.189.118.24]:38408: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:18:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-01-28 12:18:05 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:42762: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.28.168
description:
Jan 28 12:19:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.227.28.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.28.168
description:
2025-01-28 12:19:33 dovecot_plain authenticator failed for ip212-227-28-168.pbiaas.com [212.227.28.168]:65097: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 200.105.141.150
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-19.200.105.141.150


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Jan 28 12:19:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-01-28 12:19:19 dovecot_plain authenticator failed for (miterce) [65.20.160.195]:55217: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 12:19:31 dovecot_plain authenticator failed for (chnuings) [147.235.97.158]:30953: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.220.47
description:
[2025-01-28 12:20:29 +0100] info [webmaild] 168.195.220.47 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 28 12:20:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-28 12:20:35 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:49962: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 28 12:20:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-01-28 12:20:24 dovecot_plain authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:62736: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.28.168
description:
2025-01-28 12:22:22 dovecot_login authenticator failed for ip212-227-28-168.pbiaas.com [212.227.28.168]:65097: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.40.56
description:
[2025-01-28 12:23:01 +0100] info [webmaild] 187.183.40.56 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.93.252.152
description:
[2025-01-28 12:23:30 +0100] info [webmaild] 178.93.252.152 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.140.80.187
description:
[2025-01-28 12:23:46 +0100] info [webmaild] 190.140.80.187 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 12:23:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 12:23:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.14.251
description:
[2025-01-28 12:24:10 +0100] info [webmaild] 170.244.14.251 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 12:24:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (gluslic) [87.103.126.54]:52358: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.58.74.176
description:
[2025-01-28 12:24:25 +0100] info [webmaild] 103.58.74.176 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 12:24:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 12:24:01 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (kazooele) [51.255.84.180]:58300: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 12:24:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Jan 28 12:24:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.187.69.233
description:
[2025-01-28 12:24:42 +0100] info [webmaild] 78.187.69.233 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.38.37.217
description:
[2025-01-28 12:24:42 +0100] info [webmaild] 92.38.37.217 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.204.78.108
description:
[2025-01-28 12:24:43 +0100] info [webmaild] 156.204.78.108 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-01-28 12:24:44 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:43332: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 12:24:51 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:60294: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 12:25:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 12:25:40 dovecot_plain authenticator failed for (preetal) [109.166.70.166]:37359: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 28 12:24:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 28 12:24:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-28 12:25:00 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:44484: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-28 12:25:40 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:33938: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
description:
Jan 28 12:24:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
description:
2025-01-28 12:24:59 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:36437: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-28 12:25:01 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:50916: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Jan 28 12:25:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-01-28 12:25:11 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:47854: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.109.36
description:
[2025-01-28 12:25:22 +0100] info [webmaild] 157.100.109.36 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
description:
Jan 28 12:25:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.167.114.221
description:
Jan 28 12:25:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.167.114.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 28 12:25:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 28 12:26:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 12:26:20 ait sshd[3617944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Jan 28 12:26:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-01-28 12:25:54 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:58354: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 12:26:20 ait sshd[3617944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-28 12:26:20 dovecot_plain authenticator failed for (tressiver) [185.65.238.250]:48003: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-01-28 12:26:48 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:55881: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.6.61
description:
[2025-01-28 12:26:44 +0100] info [webmaild] 177.86.6.61 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Jan 28 12:25:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 59.153.18.226
description:
[2025-01-28 12:26:15 +0100] info [webmaild] 59.153.18.226 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Jan 28 12:26:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-01-28 12:26:38 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:38423: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 28 12:26:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.165
description:
Jan 28 12:27:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 12:26:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 28 12:26:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.10.21
description:
[2025-01-28 12:27:05 +0100] info [webmaild] 132.255.10.21 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 28 12:28:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 28 12:29:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:29:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 12:29:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.186.156.29
description:
[2025-01-28 12:29:36 +0100] info [webmaild] 213.186.156.29 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 28 12:28:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.184.10
description:
[2025-01-28 12:28:54 +0100] info [webmaild] 186.192.184.10 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
description:
47.128.96.165 - - [28/Jan/2025:12:30:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19936819 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=275" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.232
description:
Jan 28 12:30:39 ait sshd[3620451]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.232
description:
Jan 28 12:30:39 ait sshd[3620451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.232  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.232
description:
Jan 28 12:30:52 ait sshd[3620584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.232  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 12:31:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.232
description:
Jan 28 12:30:52 ait sshd[3620584]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.203.164.83
description:
[2025-01-28 12:31:25 +0100] info [webmaild] 91.203.164.83 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Jan 28 12:31:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.23.73
description:
[2025-01-28 12:31:26 +0100] info [webmaild] 131.255.23.73 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-01-28 12:31:36 dovecot_login authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:61310: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.150.77.197
description:
Jan 28 12:31:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.150.77.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.77.197
description:
2025-01-28 12:31:47 dovecot_login authenticator failed for 37.150.77.197.dynamic.telecom.kz [37.150.77.197]:55999: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 12:32:46 ait sshd[3621915]: Invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 45456


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 12:32:46 ait sshd[3621915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.216
description:
Jan 28 12:32:09 ait sshd[3621485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.216 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.216
description:
Jan 28 12:32:09 ait sshd[3621485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.216  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 12:32:46 ait sshd[3621915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:33:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
description:
2025-01-28 12:34:27 dovecot_plain authenticator failed for ([74.203.86.207]) [74.203.86.207]:57512: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Jan 28 12:34:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Jan 28 12:33:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 12:34:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.203.86.207
description:
Jan 28 12:34:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.203.86.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
description:
2025-01-28 12:34:31 dovecot_plain authenticator failed for ([36.154.134.146]) [36.154.134.146]:37595: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.218.198
description:
[2025-01-28 12:34:43 +0100] info [webmaild] 45.6.218.198 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-28 12:34:12 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:2111: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.134.146
description:
Jan 28 12:34:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.134.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 12:34:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-01-28 12:34:50 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:57350: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 12:34:07 dovecot_plain authenticator failed for (fandifiess) [147.235.97.158]:61087: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 28 12:34:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-01-28 12:34:37 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:63240: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.157.126
description:
Jan 28 12:34:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.157.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.157.126
description:
2025-01-28 12:34:40 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:48275: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Jan 28 12:34:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-01-28 12:33:56 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:41630: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.152.3
description:
2025-01-28 12:34:56 dovecot_login authenticator failed for ([120.197.152.3]) [120.197.152.3]:51145: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 28 12:35:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
description:
Jan 28 12:35:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 28 12:35:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 28 12:35:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.8
description:
Jan 28 12:34:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 28 12:35:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-01-28 12:35:05 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:59090: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Jan 28 12:35:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.152.3
description:
Jan 28 12:34:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.152.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-28 12:35:11 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:45647: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 207.248.125.171
description:
[2025-01-28 12:35:22 +0100] info [webmaild] 207.248.125.171 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 12:35:24 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:41462: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-28 12:35:40 dovecot_login authenticator failed for ([27.71.27.81]) [27.71.27.81]:43535: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 12:34:52 dovecot_plain authenticator failed for (gatis) [81.211.77.58]:1124: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-28 12:35:36 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:35006: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.185.227.180
description:
[2025-01-28 12:35:30 +0100] info [webmaild] 46.185.227.180 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 28 12:35:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.8
description:
2025-01-28 12:34:55 dovecot_login authenticator failed for 111-70-19-8.emome-ip.hinet.net [111.70.19.8]:40987: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 28 12:35:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
description:
2025-01-28 12:35:40 dovecot_login authenticator failed for ([60.31.181.52]) [60.31.181.52]:49380: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 28 12:36:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-28 12:36:03 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:20302: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
description:
Jan 28 12:36:17 ait sshd[3624249]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Jan 28 12:35:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
description:
Jan 28 12:35:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
description:
2025-01-28 12:35:58 dovecot_login authenticator failed for ([221.146.186.122]) [221.146.186.122]:44270: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Jan 28 12:35:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:36:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 28 12:36:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
description:
Jan 28 12:36:17 ait sshd[3624249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.26.136.128
description:
[2025-01-28 12:36:19 +0100] info [webmaild] 197.26.136.128 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:36:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.227.34
description:
[2025-01-28 12:35:55 +0100] info [webmaild] 168.196.227.34 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-01-28 12:36:00 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:55041: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.135.108.74
description:
[2025-01-28 12:36:31 +0100] info [webmaild] 185.135.108.74 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.252.225.185
description:
[2025-01-28 12:36:33 +0100] info [webmaild] 87.252.225.185 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-01-28 12:35:53 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:44330: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.134
description:
[2025-01-28 12:36:27 +0100] info [webmaild] 84.54.71.134 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-01-28 12:36:54 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:35604: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.190.122.254
description:
[2025-01-28 12:37:14 +0100] info [webmaild] 78.190.122.254 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-28 12:37:15 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:32771: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.151.177
description:
Jan 28 12:37:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.151.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 28 12:37:15 ait sshd[3624717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Jan 28 12:36:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 12:36:57 ait sshd[3624640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=sshd


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.14.122
description:
Jan 28 12:36:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 28 12:37:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 28 12:37:15 ait sshd[3624717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.151.177
description:
2025-01-28 12:37:19 dovecot_plain authenticator failed for p242177-obmd01.tokyo.ocn.ne.jp [153.141.151.177]:38773: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 12:36:57 ait sshd[3624640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Jan 28 12:37:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.30.14.122
description:
2025-01-28 12:37:01 dovecot_login authenticator failed for ([185.30.14.122]) [185.30.14.122]:43807: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:37:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 137.59.144.137
description:
[2025-01-28 12:36:54 +0100] info [webmaild] 137.59.144.137 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-01-28 12:37:27 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:46762: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-01-28 12:38:10 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:42595: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.62.136.16
description:
[2025-01-28 12:38:35 +0100] info [webmaild] 167.62.136.16 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
description:
Jan 28 12:37:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
description:
2025-01-28 12:37:56 dovecot_login authenticator failed for ([123.118.9.75]) [123.118.9.59]:45156: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Jan 28 12:38:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.161.117.18
description:
[2025-01-28 12:38:48 +0100] info [webmaild] 187.161.117.18 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:39:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.73.75.82
description:
Jan 28 12:40:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.73.75.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.73.75.82
description:
2025-01-28 12:40:19 dovecot_plain authenticator failed for ([212.73.75.82]) [212.73.75.82]:57653: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.90.7
description:
[2025-01-28 12:40:37 +0100] info [webmaild] 84.54.90.7 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:40:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 28 12:40:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-28 12:40:10 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:58105: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
description:
Jan 28 12:41:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
description:
2025-01-28 12:41:14 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:44192: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
description:
Jan 28 12:41:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.101.180.245
description:
[2025-01-28 12:41:25 +0100] info [webmaild] 179.101.180.245 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
description:
2025-01-28 12:41:25 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:41410: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:42:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
description:
2025-01-28 12:42:21 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:33227: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.239.164.190
description:
Jan 28 12:42:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.239.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.164.190
description:
2025-01-28 12:42:04 dovecot_plain authenticator failed for ([195.239.164.190]) [195.239.164.190]:32919: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Jan 28 12:42:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.255.67.116
description:
[2025-01-28 12:42:29 +0100] info [webmaild] 103.255.67.116 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.189.211.114
description:
Jan 28 12:42:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.189.211.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
description:
2025-01-28 12:42:44 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:41586: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 28 12:42:59 ait sshd[3628125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:43:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 12:43:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 12:43:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 12:43:35 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (undfinving) [91.56.31.108]:61512: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Jan 28 12:42:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-01-28 12:42:55 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:42828: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 28 12:42:59 ait sshd[3628125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 12:43:32 dovecot_plain authenticator failed for (static) [147.235.97.158]:50367: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.131
description:
[2025-01-28 12:44:41 +0100] info [cpaneld] 156.228.94.131 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.209
description:
[2025-01-28 12:44:45 +0100] info [cpaneld] 104.207.40.209 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.71
description:
[2025-01-28 12:44:46 +0100] info [cpaneld] 104.207.36.71 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.73
description:
[2025-01-28 12:44:46 +0100] info [whostmgrd] 156.228.106.73 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.89
description:
[2025-01-28 12:44:47 +0100] info [whostmgrd] 156.228.96.89 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.162
description:
[2025-01-28 12:44:48 +0100] info [whostmgrd] 156.228.110.162 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.82
description:
[2025-01-28 12:44:41 +0100] info [cpaneld] 154.214.1.82 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.51.3
description:
[2025-01-28 12:44:47 +0100] info [whostmgrd] 104.207.51.3 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.113
description:
[2025-01-28 12:44:48 +0100] info [whostmgrd] 156.228.89.113 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.166
description:
[2025-01-28 12:44:48 +0100] info [whostmgrd] 104.207.47.166 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.252
description:
[2025-01-28 12:44:42 +0100] info [cpaneld] 104.207.48.252 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.114
description:
Jan 28 12:46:44 ait sshd[3630829]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.114
description:
Jan 28 12:46:44 ait sshd[3630829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.114  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.11.101.103
description:
[2025-01-28 12:46:38 +0100] info [webmaild] 187.11.101.103 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.227.147.115
description:
[2025-01-28 12:47:22 +0100] info [webmaild] 186.227.147.115 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 12:46:52 ait sshd[3631127]: Invalid user tagrugbyinternational.com 2405 from 122.51.104.242 port 51766


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.114
description:
Jan 28 12:46:56 ait sshd[3631156]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 12:47:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.15.0.209
description:
[2025-01-28 12:47:39 +0100] info [webmaild] 187.15.0.209 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 12:46:53 ait sshd[3631127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.245.97.145
description:
[2025-01-28 12:47:05 +0100] info [webmaild] 109.245.97.145 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 12:46:53 ait sshd[3631127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.114
description:
Jan 28 12:46:56 ait sshd[3631156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.114  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.16.120.196
description:
[2025-01-28 12:47:55 +0100] info [webmaild] 181.16.120.196 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.61.100.153
description:
[2025-01-28 12:48:19 +0100] info [webmaild] 187.61.100.153 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.149.133
description:
[2025-01-28 12:48:19 +0100] info [webmaild] 177.37.149.133 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.240.132.174
description:
[2025-01-28 12:48:27 +0100] info [webmaild] 197.240.132.174 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.246.162.143
description:
[2025-01-28 12:48:01 +0100] info [webmaild] 190.246.162.143 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.184.70.253
description:
[2025-01-28 12:49:07 +0100] info [webmaild] 109.184.70.253 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
description:
Jan 28 12:49:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Jan 28 12:49:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
description:
2025-01-28 12:49:16 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:40541: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-01-28 12:49:30 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:49562: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Jan 28 12:50:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 12:50:02 ait sshd[3633267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.254
description:
Jan 28 12:50:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 28 12:50:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 12:50:02 ait sshd[3633267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 12:50:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.122.18.148
description:
Jan 28 12:49:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.122.18.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
description:
Jan 28 12:50:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Jan 28 12:50:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.193.100.15
description:
2025-01-28 12:50:03 dovecot_login authenticator failed for ([104.193.100.15]) [104.193.100.15]:39353: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-01-28 12:50:38 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:37939: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.254
description:
2025-01-28 12:50:17 dovecot_plain authenticator failed for (nsg-corporate-254.230.187.122.airtel.in) [122.187.230.254]:55105: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.180.88.72
description:
2025-01-28 12:50:21 dovecot_login authenticator failed for static-47-180-88-72.lsan.ca.frontiernet.net ([65.255.196.42]) [47.180.88.72]:37970: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-01-28 12:50:08 dovecot_login authenticator failed for ([66.11.25.195]) [66.11.25.195]:44224: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.193.100.15
description:
Jan 28 12:50:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.193.100.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-01-28 12:50:03 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:58347: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
description:
2025-01-28 12:50:07 dovecot_login authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:38397: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Jan 28 12:50:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.189.68.235
description:
[2025-01-28 12:50:16 +0100] info [webmaild] 103.189.68.235 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-28 12:50:36 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:47896: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.122.18.148
description:
2025-01-28 12:49:56 dovecot_login authenticator failed for ([202.122.18.148]) [202.122.18.148]:42638: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.88.72
description:
Jan 28 12:50:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.180.88.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.49.225.218
description:
Jan 28 12:51:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.49.225.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.49.225.218
description:
2025-01-28 12:51:41 dovecot_plain authenticator failed for (161.49.225.218.convergeict.com) [161.49.225.218]:45908: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.24.2.119
description:
[2025-01-28 12:52:38 +0100] info [webmaild] 95.24.2.119 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.151.236.178
description:
Jan 28 12:52:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.151.236.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:53:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.25.253.149
description:
[2025-01-28 12:53:11 +0100] info [webmaild] 201.25.253.149 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.173.213.202
description:
[2025-01-28 12:53:22 +0100] info [webmaild] 79.173.213.202 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
description:
Jan 28 12:52:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
description:
2025-01-28 12:52:48 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:28849: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.151.236.178
description:
2025-01-28 12:52:58 dovecot_plain authenticator failed for ([91.151.236.178]) [91.151.236.178]:60602: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 12:54:12 ait sshd[3636257]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 12:54:12 ait sshd[3636257]: Invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 50472


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 12:54:12 ait sshd[3636257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
description:
Jan 28 12:54:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 12:54:02 ait sshd[3636144]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 12:54:02 ait sshd[3636144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
description:
2025-01-28 12:54:24 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:44864: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Jan 28 12:54:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-01-28 12:54:37 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:47166: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 28 12:56:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-28 12:56:37 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (saystishe) [83.233.242.245]:57384: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 28 12:57:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-28 12:57:45 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (overant) [94.45.76.149]:45294: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-01-28 12:59:15 dovecot_login authenticator failed for ([175.156.154.149]) [175.156.154.149]:59545: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.59.2.221
description:
[2025-01-28 12:59:17 +0100] info [webmaild] 181.59.2.221 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.58.154.59
description:
Jan 28 12:59:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.58.154.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.142.16.91
description:
[2025-01-28 12:58:42 +0100] info [webmaild] 195.142.16.91 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 35.207.241.178
domain: lms.aitsmartschool.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:6.65||T:APACHE||REQUEST_URI:/wp-content/plugins/woocommerce/readme.txt||ST:500||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
description:
2025-01-28 12:59:14 dovecot_login authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:57672: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
description:
2025-01-28 12:59:16 dovecot_login authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:60658: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-01-28 12:59:20 dovecot_login authenticator failed for ([4.35.66.243]) [4.35.66.243]:38064: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.31.217
description:
[2025-01-28 12:58:42 +0100] info [webmaild] 176.29.31.217 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Jan 28 12:59:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.20.253.109
description:
Jan 28 12:59:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.20.253.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.15.58.90
description:
[2025-01-28 12:59:16 +0100] info [webmaild] 157.15.58.90 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.177.34
description:
Jan 28 12:59:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.177.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
description:
Jan 28 12:59:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Jan 28 12:59:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 12:59:19 ait sshd[3638977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.154.59
description:
2025-01-28 12:59:22 dovecot_login authenticator failed for ([101.58.154.59]) [101.58.154.59]:57146: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-28 12:59:32 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.165.140]:46254: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.53.18.44
description:
2025-01-28 12:59:41 dovecot_login authenticator failed for ([103.53.18.44]) [103.53.18.44]:44322: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.174.193.69
description:
[2025-01-28 12:59:56 +0100] info [webmaild] 103.174.193.69 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Jan 28 12:59:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Jan 28 12:59:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.252.18.246
description:
Jan 28 12:59:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.252.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-28 12:59:58 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:58797: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Jan 28 12:59:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.201
description:
Jan 28 12:59:55 ait sshd[3639172]: error: maximum authentication attempts exceeded for root from 218.92.0.201 port 33044 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
description:
2025-01-28 12:59:55 dovecot_login authenticator failed for ([175.156.139.195]) [175.156.139.195]:36036: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.177.34
description:
2025-01-28 12:59:24 dovecot_login authenticator failed for ([183.233.177.34]) [183.233.177.34]:54631: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 28 12:59:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Jan 28 12:59:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.224
description:
2025-01-28 12:59:52 dovecot_login authenticator failed for ([196.46.202.224]) [196.46.202.224]:59155: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.2
description:
Jan 28 13:00:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.2
description:
2025-01-28 13:00:02 dovecot_login authenticator failed for ([58.122.255.2]) [58.122.255.2]:35726: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 28 12:59:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
description:
2025-01-28 12:59:42 dovecot_login authenticator failed for ([221.2.207.134]) [221.2.207.134]:55998: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.146.8
description:
2025-01-28 12:59:49 dovecot_login authenticator failed for ([27.45.146.8]) [27.45.146.8]:52280: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-01-28 12:59:41 dovecot_login authenticator failed for ([111.172.120.32]) [111.172.120.32]:55874: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-01-28 12:59:43 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:34582: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-01-28 12:59:29 dovecot_login authenticator failed for ([58.224.55.22]) [58.224.55.22]:38334: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.186.33.55
description:
2025-01-28 12:59:32 dovecot_login authenticator failed for (h55.33.186.173.dynamic.ip.windstream.net) [173.186.33.55]:42818: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-01-28 12:59:53 dovecot_login authenticator failed for ([80.233.77.136]) [80.233.77.136]:7452: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-28 12:59:27 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:4977: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.22
description:
2025-01-28 12:59:41 dovecot_login authenticator failed for ([122.228.225.22]) [122.228.225.22]:44078: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Jan 28 12:59:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-01-28 12:59:29 dovecot_login authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:38266: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
description:
Jan 28 12:59:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.211.150
description:
[2025-01-28 12:59:24 +0100] info [webmaild] 177.137.211.150 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-01-28 12:59:45 dovecot_login authenticator failed for ([93.174.229.206]) [93.174.229.206]:45010: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.201
description:
Jan 28 12:59:36 ait sshd[3639172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.201  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.176.82.186
description:
[2025-01-28 13:00:21 +0100] info [webmaild] 178.176.82.186 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
description:
2025-01-28 12:59:30 dovecot_login authenticator failed for ([222.189.211.114]) [222.189.211.114]:53432: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.235.150
description:
Jan 28 13:00:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.235.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.186.33.55
description:
Jan 28 12:59:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.186.33.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Jan 28 12:59:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-01-28 12:59:56 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:41352: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.103.215
description:
2025-01-28 12:59:24 dovecot_login authenticator failed for ([222.122.103.215]) [222.122.103.215]:46330: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
description:
Jan 28 12:59:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.202.224
description:
Jan 28 12:59:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.202.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.146.8
description:
Jan 28 12:59:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.146.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
description:
Jan 28 13:00:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 28 12:59:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Jan 28 12:59:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Jan 28 12:59:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
description:
2025-01-28 12:59:39 dovecot_login authenticator failed for ([45.65.68.104]) [45.65.68.104]:56544: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-01-28 12:59:40 dovecot_login authenticator failed for ([219.248.65.30]) [219.248.65.30]:37813: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.27.12.188
description:
[2025-01-28 12:59:52 +0100] info [webmaild] 5.27.12.188 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 28 12:59:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.189.211.114
description:
Jan 28 12:59:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.189.211.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.22
description:
Jan 28 12:59:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
description:
2025-01-28 13:00:15 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:65230: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.53.18.44
description:
Jan 28 12:59:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.53.18.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.252.18.246
description:
2025-01-28 12:59:42 dovecot_login authenticator failed for ([162.252.18.246]) [162.252.18.246]:57832: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Jan 28 12:59:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.229.180
description:
[2025-01-28 13:00:26 +0100] info [webmaild] 181.94.229.180 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.24.112
description:
47.128.24.112 - - [28/Jan/2025:13:00:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16794065 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C125%2C106%2C30&filter_course-language=79%2C95&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.24.112


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.197.41.99
description:
[2025-01-28 13:01:01 +0100] info [webmaild] 181.197.41.99 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-01-28 13:01:34 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (bante) [188.127.16.197]:33938: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.12.9.29
description:
[2025-01-28 13:01:55 +0100] info [webmaild] 181.12.9.29 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Jan 28 13:01:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.229.134
description:
[2025-01-28 13:02:53 +0100] info [webmaild] 38.156.229.134 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.70.237
description:
[2025-01-28 13:04:16 +0100] info [webmaild] 187.62.70.237 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.88.245
description:
[2025-01-28 13:04:19 +0100] info [webmaild] 168.196.88.245 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.197.102
description:
Jan 28 13:03:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.197.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.197.102
description:
2025-01-28 13:03:55 dovecot_plain authenticator failed for (jabulary) [65.20.197.102]:46522: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-28 13:04:41 dovecot_plain authenticator failed for (goratate) [37.224.119.19]:37196: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.121.202.161
description:
[2025-01-28 13:04:57 +0100] info [webmaild] 168.121.202.161 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 28 13:04:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 13:05:58 ait sshd[3643994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 13:05:58 ait sshd[3643994]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 13:06:29 ait sshd[3644179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Jan 28 13:07:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 28 13:07:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-28 13:07:18 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:33892: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-01-28 13:07:05 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:52250: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 13:06:29 ait sshd[3644179]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-01-28 13:07:53 dovecot_plain authenticator failed for (dynamicip-95-79-20-9.pppoe.nn.ertelecom.ru) [95.79.20.9]:49074: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Jan 28 13:07:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Jan 28 13:08:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-01-28 13:08:04 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:57232: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Jan 28 13:09:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-28 13:10:17 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:54251: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 28 13:09:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Jan 28 13:10:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-01-28 13:09:34 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:56781: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-28 13:09:46 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:47274: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 13:09:56 ait sshd[3646509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.177.109
description:
[2025-01-28 13:09:58 +0100] info [webmaild] 45.165.177.109 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 28 13:10:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-01-28 13:10:13 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:45921: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 13:09:56 ait sshd[3646509]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.220
description:
Jan 28 13:10:12 ait sshd[3646813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.220  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.200.134.198
description:
[2025-01-28 13:11:14 +0100] info [webmaild] 37.200.134.198 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.220
description:
Jan 28 13:10:26 ait sshd[3646937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.220  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.118.157
description:
Jan 28 13:10:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.118.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.118.157
description:
2025-01-28 13:10:30 dovecot_plain authenticator failed for ([118.70.118.157]) [118.70.118.157]:40258: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.43.166.231
description:
[2025-01-28 13:11:13 +0100] info [webmaild] 190.43.166.231 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 28 13:10:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.194.241.204
description:
[2025-01-28 13:10:29 +0100] info [webmaild] 168.194.241.204 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-28 13:10:30 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:48072: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.6.3.215
description:
[2025-01-28 13:11:15 +0100] info [webmaild] 191.6.3.215 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.80.71.213
description:
[2025-01-28 13:12:19 +0100] info [webmaild] 189.80.71.213 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.105.236.203
description:
[2025-01-28 13:11:45 +0100] info [webmaild] 176.105.236.203 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 13:11:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.237.202.22
description:
[2025-01-28 13:11:52 +0100] info [webmaild] 176.237.202.22 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.197.126.103
description:
2025-01-28 13:12:26 dovecot_plain authenticator failed for (rerecus) [2.197.126.103]:35270: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.197.126.103
description:
Jan 28 13:12:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.197.126.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.91.128.70
description:
[2025-01-28 13:12:27 +0100] info [webmaild] 103.91.128.70 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.167.136
description:
[2025-01-28 13:13:00 +0100] info [webmaild] 177.66.167.136 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.40.63
description:
2025-01-28 13:13:47 dovecot_plain authenticator failed for c188-150-40-63.bredband.tele2.se (anizeries) [188.150.40.63]:35134: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 13:14:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.53.194.42
description:
[2025-01-28 13:13:44 +0100] info [webmaild] 200.53.194.42 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.253.248
description:
2025-01-28 13:13:44 dovecot_plain authenticator failed for host-37-99-253-248.geny.it (idess) [37.99.253.248]:42682: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.40.63
description:
Jan 28 13:13:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.40.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.99.253.248
description:
Jan 28 13:13:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.99.253.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-28 13:15:19 dovecot_plain authenticator failed for (forbury) [102.53.15.56]:45332: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.178
description:
2025-01-28 13:15:21 dovecot_plain authenticator failed for 202-4-196-178.static.pccw-hkt.com [202.4.196.178]:55732: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.158.17.199
description:
[2025-01-28 13:14:51 +0100] info [webmaild] 146.158.17.199 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.10.80.189
description:
2025-01-28 13:15:00 dovecot_plain authenticator failed for (fruism) [85.10.80.189]:58241: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 28 13:15:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.178
description:
Jan 28 13:15:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 28 13:15:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.10.80.189
description:
Jan 28 13:14:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.10.80.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 13:15:27 ait sshd[3650782]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-28 13:15:24 dovecot_plain authenticator failed for (munfically) [77.51.214.170]:56780: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.127.40.156
description:
[2025-01-28 13:15:45 +0100] info [webmaild] 189.127.40.156 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
description:
Jan 28 13:15:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
description:
2025-01-28 13:15:30 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:51377: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-01-28 13:15:39 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:39414: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.174.226
description:
Jan 28 13:15:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.174.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.28.199
description:
[2025-01-28 13:16:19 +0100] info [webmaild] 177.11.28.199 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 13:15:27 ait sshd[3650782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Jan 28 13:15:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.174.226
description:
2025-01-28 13:15:49 dovecot_plain authenticator failed for ([58.216.174.226]) [58.216.174.226]:12850: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 28 13:16:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-28 13:16:59 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (nonatalner) [91.200.226.218]:42412: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 13:17:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.112.194
description:
[2025-01-28 13:16:51 +0100] info [webmaild] 45.238.112.194 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
description:
Jan 28 13:19:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 28 13:20:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.63.180.167
description:
2025-01-28 13:20:23 dovecot_plain authenticator failed for lstlambert-656-1-272-167.w90-63.abo.wanadoo.fr (sumbecry) [90.63.180.167]:55870: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.63.180.167
description:
Jan 28 13:20:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.63.180.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-28 13:20:24 dovecot_plain authenticator failed for (sopred) [109.108.95.66]:42940: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.212.143.84
description:
[2025-01-28 13:21:14 +0100] info [webmaild] 186.212.143.84 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.47.51
description:
[2025-01-28 13:22:36 +0100] info [webmaild] 191.99.47.51 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 28 13:22:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-28 13:22:49 dovecot_plain authenticator failed for (unmilly) [89.23.210.188]:58229: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 13:22:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 28 13:22:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Jan 28 13:22:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-01-28 13:22:49 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:45468: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-28 13:22:38 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:59980: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.234.25.245
description:
[2025-01-28 13:23:32 +0100] info [webmaild] 91.234.25.245 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.89
description:
Jan 28 13:24:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.89
description:
2025-01-28 13:24:12 dovecot_plain authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:53350: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 28 13:23:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 13:23:26 ait sshd[3657096]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 13:23:26 ait sshd[3657096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 28 13:23:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-28 13:23:42 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (spallyst) [62.63.230.241]:59584: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Jan 28 13:24:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-01-28 13:24:20 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:54734: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 13:23:36 ait sshd[3657141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.8.64.18
description:
[2025-01-28 13:23:38 +0100] info [webmaild] 201.8.64.18 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.151.139
description:
[2025-01-28 13:24:00 +0100] info [webmaild] 170.81.151.139 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-28 13:24:00 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:41582: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
description:
2025-01-28 13:24:02 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:49287: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 13:23:36 ait sshd[3657141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.123.13
description:
[2025-01-28 13:23:38 +0100] info [webmaild] 177.39.123.13 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
description:
Jan 28 13:24:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.30.251
description:
[2025-01-28 13:24:34 +0100] info [webmaild] 45.226.30.251 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.205.199.175
description:
[2025-01-28 13:24:23 +0100] info [webmaild] 186.205.199.175 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.253.55.165
description:
[2025-01-28 13:24:45 +0100] info [webmaild] 191.253.55.165 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.18.2
description:
2025-01-28 13:25:46 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.18.2]:52489: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 28 13:25:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.92.193
description:
Jan 28 13:25:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.92.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-28 13:25:31 dovecot_login authenticator failed for (mail.salee.co.kr) [220.90.239.158]:62945: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-01-28 13:25:40 dovecot_login authenticator failed for ([27.125.174.202]) [27.125.174.202]:54239: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 28 13:25:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.19.34
description:
[2025-01-28 13:26:01 +0100] info [webmaild] 179.6.19.34 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.212.127.101
description:
[2025-01-28 13:25:25 +0100] info [webmaild] 177.212.127.101 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
description:
Jan 28 13:25:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.18.2
description:
Jan 28 13:25:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.18.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.193
description:
Jan 28 13:25:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
description:
2025-01-28 13:25:33 dovecot_login authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:56033: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-28 13:25:52 dovecot_login authenticator failed for ([59.9.38.92]) [59.9.38.92]:47702: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.193
description:
2025-01-28 13:25:26 dovecot_login authenticator failed for (nsg-corporate-193.227.187.122.airtel.in) [122.187.227.193]:33762: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.229.84.46
description:
[2025-01-28 13:27:08 +0100] info [webmaild] 185.229.84.46 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.227.57.161
description:
[2025-01-28 13:27:11 +0100] info [webmaild] 41.227.57.161 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-01-28 13:27:53 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:51528: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Jan 28 13:27:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-01-28 13:27:33 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:62330: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.249.43.219
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:abubakartankojr@gmail.com||WPU:abubakartankojr@gmail.com||RSV:6.65||T:APACHE||MV:13-27.173.249.43.219


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.112
description:
Jan 28 13:27:44 ait sshd[3659812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.112
description:
Jan 28 13:27:44 ait sshd[3659812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.112  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Jan 28 13:27:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
description:
Jan 28 13:29:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.197.126.103
description:
Jan 28 13:28:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.197.126.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.197.126.103
description:
2025-01-28 13:28:50 dovecot_plain authenticator failed for (spexasiodo) [2.197.126.103]:53950: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.250.42.227
description:
[2025-01-28 13:29:04 +0100] info [webmaild] 154.250.42.227 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.9.124
description:
[2025-01-28 13:29:11 +0100] info [webmaild] 177.73.9.124 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 13:29:55 dovecot_plain authenticator failed for (nondid) [109.166.70.166]:54471: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.219.110.215
description:
2025-01-28 13:29:55 dovecot_plain authenticator failed for 124-219-110-215.vdslpro.static.apol.com.tw [124.219.110.215]:39200: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.207
description:
[2025-01-28 13:30:16 +0100] info [cpaneld] 156.228.114.207 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.19
description:
[2025-01-28 13:30:20 +0100] info [cpaneld] 156.228.124.19 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
description:
2025-01-28 13:29:22 dovecot_plain authenticator failed for ([111.39.206.23]) [111.39.206.23]:43917: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 13:29:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.219.110.215
description:
Jan 28 13:29:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.219.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.17
description:
[2025-01-28 13:30:19 +0100] info [cpaneld] 104.207.50.17 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.160
description:
[2025-01-28 13:30:21 +0100] info [whostmgrd] 156.228.125.160 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.150
description:
[2025-01-28 13:30:18 +0100] info [cpaneld] 156.228.125.150 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.119
description:
[2025-01-28 13:30:20 +0100] info [whostmgrd] 156.228.105.119 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 13:30:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.22
description:
[2025-01-28 13:30:17 +0100] info [cpaneld] 104.207.57.22 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.97.63.209
description:
Jan 28 13:31:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.97.63.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.113
description:
[2025-01-28 13:30:23 +0100] info [whostmgrd] 156.228.85.113 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.92
description:
[2025-01-28 13:30:24 +0100] info [whostmgrd] 156.228.109.92 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.76.124
description:
[2025-01-28 13:30:25 +0100] info [whostmgrd] 156.228.76.124 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.63.209
description:
2025-01-28 13:31:22 dovecot_plain authenticator failed for ([211.97.63.209]) [211.97.63.209]:37100: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.93
description:
[2025-01-28 13:30:25 +0100] info [whostmgrd] 156.228.85.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
description:
Jan 28 13:30:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.108.46
description:
Jan 28 13:31:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.108.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.108.46
description:
2025-01-28 13:31:05 dovecot_plain authenticator failed for ([212.90.108.46]) [212.90.108.46]:41177: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Jan 28 13:31:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-01-28 13:31:46 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:48098: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Jan 28 13:31:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-01-28 13:31:56 dovecot_plain authenticator failed for ([221.195.208.171]) [221.195.208.171]:61394: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.249.43.219
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ing.stepsparku@engineer.com||WPU:ing.stepsparku@engineer.com||RSV:6.65||T:APACHE||MV:13-32.173.249.43.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.252.218
description:
Jan 28 13:33:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.252.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
description:
2025-01-28 13:33:18 dovecot_plain authenticator failed for 81-234-121-57-no600.tbcn.telia.com (schees) [81.234.121.57]:36050: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.252.218
description:
2025-01-28 13:33:08 dovecot_plain authenticator failed for ([220.189.252.218]) [220.189.252.218]:50478: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.234.121.57
description:
Jan 28 13:33:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.234.121.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.61.24
description:
2025-01-28 13:33:19 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.61.24]:8364: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-28 13:33:24 dovecot_plain authenticator failed for s2.legionusa.com (wartines) [159.203.87.228]:59372: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.15.94
description:
[2025-01-28 13:33:24 +0100] info [webmaild] 191.99.15.94 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 28 13:33:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-28 13:33:29 dovecot_plain authenticator failed for (desporiked) [65.20.143.159]:54163: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 13:33:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 13:33:42 dovecot_plain authenticator failed for (coplabla) [46.30.161.197]:38440: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 28 13:33:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Jan 28 13:34:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-01-28 13:34:49 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:34808: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-28 13:34:56 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (unloes) [109.164.246.53]:32806: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Jan 28 13:34:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-01-28 13:34:38 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:40555: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 28 13:34:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.250.138
description:
[2025-01-28 13:35:07 +0100] info [webmaild] 201.182.250.138 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 13:35:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.249.194
description:
[2025-01-28 13:35:54 +0100] info [webmaild] 138.117.249.194 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.179.222
description:
[2025-01-28 13:35:55 +0100] info [webmaild] 189.106.179.222 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.197.21
description:
[2025-01-28 13:36:01 +0100] info [webmaild] 37.237.197.21 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.197.222.52
description:
Jan 28 13:36:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.197.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.197.222.52
description:
2025-01-28 13:36:18 dovecot_plain authenticator failed for ([60.29.51.54]) [221.197.222.52]:38780: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-01-28 13:36:48 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:56980: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
description:
Jan 28 13:37:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.54.36
description:
Jan 28 13:37:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.54.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
description:
2025-01-28 13:37:02 dovecot_plain authenticator failed for data.autofrant.ru (hadon) [151.248.116.230]:50570: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 13:37:13 ait sshd[3664754]: Invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 36218


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 13:37:13 ait sshd[3664754]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 28 13:36:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-28 13:36:32 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:59974: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 28 13:36:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.41.110
description:
[2025-01-28 13:36:52 +0100] info [webmaild] 177.38.41.110 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
description:
2025-01-28 13:37:02 dovecot_plain authenticator failed for ([60.172.54.36]) [60.172.54.36]:49550: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.118.78.141
description:
[2025-01-28 13:37:16 +0100] info [webmaild] 103.118.78.141 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.83.179.203
description:
[2025-01-28 13:36:33 +0100] info [webmaild] 179.83.179.203 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-28 13:36:41 dovecot_plain authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:40996: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Jan 28 13:36:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 13:37:13 ait sshd[3664754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 28 13:36:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-28 13:36:32 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:45908: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-01-28 13:38:05 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:64546: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.50.14
description:
2025-01-28 13:37:49 dovecot_plain authenticator failed for (201-91-49-72.customer.tdatabrasil.net.br) [187.92.50.14]:56158: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.1.135.228
description:
[2025-01-28 13:38:06 +0100] info [webmaild] 201.1.135.228 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.71.17.53
description:
[2025-01-28 13:37:25 +0100] info [webmaild] 105.71.17.53 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Jan 28 13:38:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.50.14
description:
Jan 28 13:37:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.50.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.102
description:
47.128.47.102 - - [28/Jan/2025:13:38:56 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8667588 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/info.php?id=817" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.127.127.37
description:
[2025-01-28 13:38:58 +0100] info [webmaild] 185.127.127.37 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 13:38:26 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (bearizer) [51.255.84.180]:37212: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.251.106.99
description:
[2025-01-28 13:38:31 +0100] info [webmaild] 179.251.106.99 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 13:38:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 13:39:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 13:38:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.36.116
description:
[2025-01-28 13:39:36 +0100] info [webmaild] 191.99.36.116 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 13:39:47 ait sshd[3666032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 13:39:47 ait sshd[3666032]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
description:
Jan 28 13:40:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
description:
2025-01-28 13:41:00 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:52109: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 28 13:41:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-01-28 13:40:47 dovecot_plain authenticator failed for ([179.185.1.177]) [179.185.1.177]:38661: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 28 13:41:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-28 13:41:39 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:51261: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.54.12.141
description:
[2025-01-28 13:42:00 +0100] info [webmaild] 191.54.12.141 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Jan 28 13:41:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-01-28 13:41:30 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:55703: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.225.197.159
description:
[2025-01-28 13:41:31 +0100] info [webmaild] 45.225.197.159 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Jan 28 13:42:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-28 13:42:27 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:59858: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 4.153.178.110
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-42.4.153.178.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-01-28 13:42:39 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:59092: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 13:42:44 ait sshd[3667891]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 13:42:44 ait sshd[3667891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-28 13:44:03 dovecot_plain authenticator failed for (sargistas) [102.53.15.56]:34528: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 28 13:44:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 28 13:43:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-28 13:44:01 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (zinats) [176.37.212.85]:46988: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 13:44:20 ait sshd[3668556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 13:44:20 ait sshd[3668556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 13:43:39 ait sshd[3668280]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 13:43:39 ait sshd[3668280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Jan 28 13:44:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-01-28 13:44:55 dovecot_plain authenticator failed for ([80.233.77.136]) [80.233.77.136]:4564: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.249.45.26
description:
[2025-01-28 13:44:31 +0100] info [webmaild] 152.249.45.26 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 28 13:44:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-28 13:44:43 dovecot_plain authenticator failed for ([185.123.78.12]) [185.123.78.13]:23267: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Jan 28 13:45:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Jan 28 13:46:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-01-28 13:46:12 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:21995: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-01-28 13:45:56 dovecot_plain authenticator failed for (189-56-217-183.customer.tdatabrasil.net.br) [189.56.217.183]:37568: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 13:46:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.18.179.132
description:
[2025-01-28 13:47:33 +0100] info [webmaild] 177.18.179.132 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 13:47:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 13:47:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 13:47:36 ait sshd[3670028]: Invalid user tagrugbyinternational.com 2405 from 122.51.104.242 port 42854


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 13:47:36 ait sshd[3670028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 13:47:36 ait sshd[3670028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.141.117.245
description:
[2025-01-28 13:48:01 +0100] info [webmaild] 94.141.117.245 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.218.159.85
description:
[2025-01-28 13:48:22 +0100] info [webmaild] 201.218.159.85 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.136.182.60
description:
[2025-01-28 13:49:03 +0100] info [webmaild] 177.136.182.60 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.66.158
description:
[2025-01-28 13:49:22 +0100] info [webmaild] 168.232.66.158 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.77.223
description:
[2025-01-28 13:48:29 +0100] info [webmaild] 103.135.77.223 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.82.4
description:
[2025-01-28 13:48:30 +0100] info [webmaild] 45.179.82.4 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 13:49:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 13:49:02 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (quadam) [51.255.84.180]:52784: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.104.45.14
description:
[2025-01-28 13:49:45 +0100] info [webmaild] 190.104.45.14 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.75.45.32
description:
[2025-01-28 13:50:04 +0100] info [webmaild] 189.75.45.32 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
description:
2025-01-28 13:52:10 dovecot_plain authenticator failed for ([39.155.170.146]) [39.155.170.146]:36317: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
description:
Jan 28 13:52:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
description:
2025-01-28 13:52:22 dovecot_plain authenticator failed for ([124.239.169.52]) [124.239.169.52]:51133: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 13:51:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.79.25
description:
[2025-01-28 13:51:48 +0100] info [webmaild] 177.221.79.25 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
description:
Jan 28 13:52:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 13:52:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
description:
2025-01-28 13:53:34 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:59614: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Jan 28 13:53:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-01-28 13:53:43 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:50120: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-28 13:54:17 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:36203: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.57.144.146
description:
[2025-01-28 13:53:25 +0100] info [webmaild] 37.57.144.146 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 13:53:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.1.60
description:
Jan 28 13:53:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.1.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 28 13:54:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Jan 28 13:54:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-01-28 13:54:20 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:34213: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.46.239
description:
2025-01-28 13:54:30 dovecot_plain authenticator failed for (abts-north-static-239.46.176.122.airtelbroadband.in) [122.176.46.239]:36099: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.13.240
description:
Jan 28 13:54:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.13.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.240
description:
2025-01-28 13:54:36 dovecot_plain authenticator failed for 111-70-13-240.emome-ip.hinet.net [111.70.13.240]:34187: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.46.239
description:
Jan 28 13:54:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.46.239 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.72.217.238
description:
[2025-01-28 13:54:42 +0100] info [webmaild] 185.72.217.238 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.116.41.2
description:
Jan 28 13:55:04 ait sshd[3673710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.116.41.2  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.247.77
description:
[2025-01-28 13:55:40 +0100] info [webmaild] 177.223.247.77 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-01-28 13:56:55 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:39174: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
description:
2025-01-28 13:57:16 dovecot_plain authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:33580: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 13:56:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Jan 28 13:56:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 13:57:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.195.36.242
description:
Jan 28 13:57:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.195.36.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
description:
2025-01-28 13:56:38 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (sated) [5.185.233.251]:47024: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.233.251
description:
Jan 28 13:56:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.233.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.20.253.109
description:
Jan 28 13:57:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.20.253.109 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.72.125.16
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-56.94.72.125.16


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.195.36.242
description:
2025-01-28 13:57:07 dovecot_plain authenticator failed for ([175.195.36.242]) [175.195.36.242]:56190: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 13:56:34 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (picargent) [109.67.154.24]:40340: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 13:56:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
description:
Jan 28 13:57:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
description:
Jan 28 13:57:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
description:
2025-01-28 13:57:31 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:46661: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
description:
2025-01-28 13:57:49 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (dellentack) [78.68.37.25]:55683: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.116.41.2
description:
Jan 28 13:58:35 ait sshd[3675098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.116.41.2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.208.4
description:
2025-01-28 13:58:37 dovecot_plain authenticator failed for ([103.81.208.4]) [103.81.208.4]:55186: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
description:
Jan 28 13:58:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
description:
2025-01-28 13:58:27 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:55764: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.208.4
description:
Jan 28 13:58:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.208.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.116.41.2
description:
Jan 28 13:58:35 ait sshd[3675098]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.116.41.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 13:59:27 ait sshd[3675304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 13:59:33 ait sshd[3675315]: Invalid user tagrugbyinternational.com 2405 from 122.51.104.242 port 48112


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 13:59:34 ait sshd[3675315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
description:
Jan 28 13:59:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 13:59:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.45.10
description:
2025-01-28 13:59:46 dovecot_plain authenticator failed for ([125.32.45.10]) [125.32.45.10]:36696: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 13:59:34 ait sshd[3675315]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.45.10
description:
Jan 28 13:59:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
description:
2025-01-28 13:59:57 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:60602: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 13:59:27 ait sshd[3675304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 13:59:25 dovecot_plain authenticator failed for (wagge) [81.211.77.58]:41273: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 13:59:27 ait sshd[3675304]: Invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 55022


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.120.195.11
description:
[2025-01-28 13:59:23 +0100] info [webmaild] 94.120.195.11 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.41.173.101
description:
[2025-01-28 14:00:23 +0100] info [webmaild] 176.41.173.101 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 203.128.24.197
description:
[2025-01-28 14:00:32 +0100] info [webmaild] 203.128.24.197 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.223.28
description:
[2025-01-28 14:00:58 +0100] info [webmaild] 45.168.223.28 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.133.191
description:
[2025-01-28 14:00:31 +0100] info [webmaild] 179.125.133.191 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.102.139.70
description:
[2025-01-28 14:01:19 +0100] info [webmaild] 103.102.139.70 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.121.16.58
description:
[2025-01-28 14:01:23 +0100] info [webmaild] 190.121.16.58 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
description:
Jan 28 14:01:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-01-28 14:02:08 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:45300: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.108.255.92
description:
[2025-01-28 14:02:17 +0100] info [webmaild] 131.108.255.92 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.36.153.41
description:
[2025-01-28 14:01:26 +0100] info [webmaild] 200.36.153.41 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 14:01:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
description:
2025-01-28 14:01:58 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:43242: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Jan 28 14:02:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 28 14:03:04 ait sshd[3677121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.27.213.155
description:
[2025-01-28 14:02:49 +0100] info [webmaild] 201.27.213.155 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.73.238
description:
[2025-01-28 14:02:58 +0100] info [webmaild] 179.106.73.238 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 28 14:03:04 ait sshd[3677121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 14:03:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 14:03:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.183.168.11
description:
[2025-01-28 14:04:02 +0100] info [webmaild] 189.183.168.11 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 28 14:05:00 ait sshd[3677930]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 28 14:05:00 ait sshd[3677930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
description:
2025-01-28 14:05:33 dovecot_plain authenticator failed for (psocoly) [65.20.200.71]:47609: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.95.220.113
description:
[2025-01-28 14:05:37 +0100] info [webmaild] 200.95.220.113 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.154.46.138
description:
Jan 28 14:06:00 ait sshd[3678469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 90.154.46.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
description:
Jan 28 14:05:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 14:05:51 ait sshd[3678432]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 14:05:51 ait sshd[3678432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.219.109
description:
Jan 28 14:06:00 ait sshd[3678464]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.231.219.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.231.219.109
description:
Jan 28 14:06:00 ait sshd[3678464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.231.219.109


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 90.154.46.138
description:
Jan 28 14:06:00 ait sshd[3678469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=90.154.46.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
description:
Jan 28 14:06:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
description:
2025-01-28 14:06:59 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:40722: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 14:07:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.176.102
description:
[2025-01-28 14:07:07 +0100] info [webmaild] 151.236.176.102 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.250.133
description:
[2025-01-28 14:07:09 +0100] info [webmaild] 201.148.250.133 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 28 14:06:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-28 14:06:49 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:52630: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-01-28 14:07:34 dovecot_plain authenticator failed for ([1.183.1.82]) [1.183.1.82]:46016: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.65.227.12
description:
Jan 28 14:07:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.65.227.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.65.227.12
description:
2025-01-28 14:07:47 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:43461: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 14:07:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
description:
Jan 28 14:07:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.193.234.210
description:
Jan 28 14:09:04 ait sshd[3679638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.193.234.210


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.214.159.245
description:
Jan 28 14:09:05 ait sshd[3679655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.214.159.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Jan 28 14:09:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-01-28 14:09:14 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:45584: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.214.159.245
description:
Jan 28 14:09:05 ait sshd[3679655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.214.159.245


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 14:09:09 ait sshd[3679683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 14:08:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 14:08:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 14:09:09 ait sshd[3679683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 28 14:09:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-28 14:09:56 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (evoliver) [2.139.88.148]:40138: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 28 14:09:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.239
description:
2025-01-28 14:09:26 dovecot_plain authenticator failed for 111-70-23-239.emome-ip.hinet.net [111.70.23.239]:42750: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.219.109
description:
Jan 28 14:10:22 ait sshd[3680425]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.231.219.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.231.219.109
description:
Jan 28 14:10:22 ait sshd[3680425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.231.219.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.239
description:
Jan 28 14:09:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.122.187.84
description:
2025-01-28 14:09:36 dovecot_plain authenticator failed for ([216.122.187.84]) [216.122.187.84]:64470: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 14:10:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.123.53.43
description:
Jan 28 14:11:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.123.53.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.123.53.43
description:
2025-01-28 14:11:10 dovecot_plain authenticator failed for ([36.32.223.199]) [112.123.53.43]:20634: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.193.234.210
description:
Jan 28 14:11:21 ait sshd[3680931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.193.234.210


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.231.219.109
description:
Jan 28 14:10:25 ait sshd[3680425]: Failed password for invalid user ftpuser from 91.231.219.109 port 7964 ssh2


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 113.193.234.210
description:
Jan 28 14:11:23 ait sshd[3680931]: Failed password for invalid user admin from 113.193.234.210 port 38908 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.143
description:
Jan 28 14:11:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
description:
Jan 28 14:11:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.154.46.138
description:
Jan 28 14:11:38 ait sshd[3681007]: pam_imunify(sshd:auth): [IM360_RBL] The IP 90.154.46.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 90.154.46.138
description:
Jan 28 14:11:38 ait sshd[3681007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=90.154.46.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-01-28 14:11:41 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:33754: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Jan 28 14:11:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.219.109
description:
Jan 28 14:11:40 ait sshd[3681185]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.231.219.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.231.219.109
description:
Jan 28 14:11:40 ait sshd[3681185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.231.219.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.83.170
description:
[2025-01-28 14:11:39 +0100] info [webmaild] 189.28.83.170 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.231.219.109
description:
Jan 28 14:11:43 ait sshd[3681185]: Failed password for invalid user test from 91.231.219.109 port 11444 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-28 14:11:54 dovecot_plain authenticator failed for (tulan) [109.160.123.6]:40666: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.143
description:
2025-01-28 14:11:28 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.143]:10797: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-01-28 14:11:31 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:60648: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 28 14:11:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.66.37.100
description:
[2025-01-28 14:12:36 +0100] info [webmaild] 201.66.37.100 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.237.253.75
description:
[2025-01-28 14:12:45 +0100] info [webmaild] 154.237.253.75 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.193.234.210
description:
Jan 28 14:12:46 ait sshd[3681697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.193.234.210


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.154.46.138
description:
Jan 28 14:13:16 ait sshd[3681962]: pam_imunify(sshd:auth): [IM360_RBL] The IP 90.154.46.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.127.82.209
description:
[2025-01-28 14:12:35 +0100] info [webmaild] 189.127.82.209 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 90.154.46.138
description:
Jan 28 14:13:16 ait sshd[3681962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=90.154.46.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.241.169
description:
[2025-01-28 14:12:44 +0100] info [webmaild] 170.150.241.169 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.214.159.245
description:
Jan 28 14:13:13 ait sshd[3681956]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.214.159.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.214.159.245
description:
Jan 28 14:13:13 ait sshd[3681956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.214.159.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.75.72.71
description:
[2025-01-28 14:13:26 +0100] info [webmaild] 187.75.72.71 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 175.41.46.34
description:
[2025-01-28 14:13:26 +0100] info [webmaild] 175.41.46.34 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.122.187.84
description:
2025-01-28 14:13:32 dovecot_plain authenticator failed for ([216.122.187.84]) [216.122.187.84]:49250: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.145.221
description:
[2025-01-28 14:13:40 +0100] info [webmaild] 138.0.145.221 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 14:14:14 ait sshd[3682563]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 14:14:14 ait sshd[3682563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.71.65.0
description:
[2025-01-28 14:14:38 +0100] info [webmaild] 200.71.65.0 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 14:15:14 ait sshd[3683134]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 14:15:21 ait sshd[3683160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 14:15:22 ait sshd[3683162]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 14:15:22 ait sshd[3683162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.190.132.8
description:
[2025-01-28 14:14:27 +0100] info [webmaild] 103.190.132.8 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.94.28
description:
[2025-01-28 14:15:09 +0100] info [webmaild] 177.73.94.28 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 14:15:14 ait sshd[3683134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=ftp


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 14:15:21 ait sshd[3683160]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 14:15:36 ait sshd[3683231]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
description:
Jan 28 14:16:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
description:
2025-01-28 14:16:04 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:49704: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 14:15:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 28 14:15:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 28 14:15:24 ait sshd[3683160]: Failed password for invalid user ijari from 210.180.118.166 port 33498 ssh2


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.117.200.149
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-16.109.117.200.149


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 14:15:36 ait sshd[3683231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-28 14:15:52 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:16086: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.99.237.249
description:
Jan 28 14:16:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.99.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.214.159.245
description:
Jan 28 14:17:07 ait sshd[3683959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.214.159.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.214.159.245
description:
Jan 28 14:17:07 ait sshd[3683959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.214.159.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-28 14:16:47 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:25150: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 28 14:16:25 ait sshd[3683687]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 28 14:16:25 ait sshd[3683687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.43.130.173
description:
[2025-01-28 14:16:25 +0100] info [webmaild] 38.43.130.173 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
description:
2025-01-28 14:16:28 dovecot_plain authenticator failed for ([222.99.237.249]) [222.99.237.249]:40698: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 28 14:16:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 14:18:22 ait sshd[3684393]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 14:18:22 ait sshd[3684393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 28 14:17:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.178.187.103
description:
[2025-01-28 14:17:51 +0100] info [webmaild] 103.178.187.103 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-28 14:17:50 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net (makegly) [51.77.193.92]:42858: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.102.150
description:
[2025-01-28 14:18:20 +0100] info [webmaild] 213.230.102.150 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 14:18:22 ait sshd[3684393]: Invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 60266


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.235.131.117
description:
[2025-01-28 14:19:16 +0100] info [webmaild] 105.235.131.117 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 14:18:25 ait sshd[3684393]: Failed password for invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 60266 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 28 14:19:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-28 14:19:26 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (mulanmened) [2.139.88.148]:50462: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Jan 28 14:20:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.87.21.146
description:
Jan 28 14:21:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.87.21.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.144.42.158
description:
Jan 28 14:21:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.144.42.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-01-28 14:20:44 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:34678: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.87.21.146
description:
2025-01-28 14:21:07 dovecot_plain authenticator failed for ([218.87.21.146]) [218.87.21.146]:45595: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.144.42.158
description:
2025-01-28 14:21:23 dovecot_plain authenticator failed for (TINY-308480B7) [136.144.42.158]:30163: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.144.42.158
description:
Jan 28 14:21:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.144.42.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.206
description:
Jan 28 14:21:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.206
description:
2025-01-28 14:21:34 dovecot_plain authenticator failed for (peotor) [65.20.168.206]:55344: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 14:21:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
description:
2025-01-28 14:23:18 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:39570: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.21
description:
47.128.96.21 - - [28/Jan/2025:14:22:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22920333 HTTP/2.0" 302 0 elibrary.ait-edu.us "https://elibrary.ait-edu.us/ebook/fundamentals-of-engineering-mechanics/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 14:22:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Jan 28 14:23:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-01-28 14:23:08 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:53278: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
description:
Jan 28 14:23:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
description:
Jan 28 14:23:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
description:
2025-01-28 14:23:39 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:34946: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.221.254.62
description:
[2025-01-28 14:23:53 +0100] info [webmaild] 103.221.254.62 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.87.92
description:
[2025-01-28 14:23:54 +0100] info [webmaild] 177.66.87.92 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
description:
Jan 28 14:23:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
description:
2025-01-28 14:23:29 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:36193: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.103.187.12
description:
Jan 28 14:24:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.103.187.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.103.187.12
description:
2025-01-28 14:24:25 dovecot_plain authenticator failed for (coiddle) [88.103.187.12]:46080: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.153.96.146
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:14-24.54.153.96.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.36.208.148
description:
[2025-01-28 14:24:56 +0100] info [webmaild] 212.36.208.148 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.42.95.30
description:
[2025-01-28 14:24:56 +0100] info [webmaild] 24.42.95.30 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.61
description:
[2025-01-28 14:25:19 +0100] info [cpaneld] 156.228.112.61 - eng16b00239y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng16b00239y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.75.60.30
description:
[2025-01-28 14:24:46 +0100] info [webmaild] 196.75.60.30 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.38
description:
[2025-01-28 14:25:21 +0100] info [cpaneld] 104.207.61.38 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.208
description:
Jan 28 14:26:09 ait sshd[3688254]: error: maximum authentication attempts exceeded for root from 218.92.0.208 port 54846 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.88.52
description:
[2025-01-28 14:25:25 +0100] info [whostmgrd] 156.228.88.52 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.151
description:
[2025-01-28 14:25:25 +0100] info [whostmgrd] 156.228.99.151 - eng16b00239y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.246
description:
[2025-01-28 14:25:27 +0100] info [whostmgrd] 156.228.104.246 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.4.232
description:
[2025-01-28 14:25:38 +0100] info [webmaild] 177.11.4.232 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.187
description:
[2025-01-28 14:25:24 +0100] info [cpaneld] 156.228.96.187 - eng16b00239y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng16b00239y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.54
description:
[2025-01-28 14:25:27 +0100] info [whostmgrd] 104.207.56.54 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.218
description:
[2025-01-28 14:25:28 +0100] info [whostmgrd] 156.228.101.218 - eng16b00239y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.38
description:
[2025-01-28 14:25:23 +0100] info [cpaneld] 156.228.80.38 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.37.92
description:
[2025-01-28 14:25:24 +0100] info [cpaneld] 104.207.37.92 - eng16b00239y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng16b00239y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.168.125.82
description:
[2025-01-28 14:25:34 +0100] info [webmaild] 105.168.125.82 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.208
description:
Jan 28 14:25:47 ait sshd[3688254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.208  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.208
description:
Jan 28 14:25:47 ait sshd[3688254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.99.32.6
description:
[2025-01-28 14:26:01 +0100] info [webmaild] 185.99.32.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.73.123.147
description:
[2025-01-28 14:27:00 +0100] info [webmaild] 41.73.123.147 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 14:27:11 ait sshd[3688968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 14:27:21 ait sshd[3689084]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.224.129.97
description:
Jan 28 14:26:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.224.129.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.245.168
description:
[2025-01-28 14:26:43 +0100] info [webmaild] 176.29.245.168 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 14:27:11 ait sshd[3688968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 14:27:21 ait sshd[3689084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-28 14:28:02 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:55985: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 28 14:28:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-28 14:28:14 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:52151: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.151.11
description:
[2025-01-28 14:27:39 +0100] info [webmaild] 177.39.151.11 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.61.10.212
description:
Jan 28 14:27:23 ait sshd[3689084]: Failed password for invalid user jaster from 182.61.10.212 port 47846 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.229
description:
Jan 28 14:27:24 ait sshd[3689089]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.229
description:
Jan 28 14:27:24 ait sshd[3689089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.229  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 28 14:28:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 14:28:30 ait sshd[3689600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 14:28:30 ait sshd[3689600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.49.41
description:
[2025-01-28 14:28:35 +0100] info [webmaild] 131.161.49.41 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 14:29:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 14:29:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 14:28:30 ait sshd[3689600]: Invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 56162


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.213.189
description:
2025-01-28 14:30:10 H=(mail.ait-edu.us) [165.154.213.189]:52578 F=<lgsftva@ait-edu.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.86.137.117
description:
[2025-01-28 14:29:39 +0100] info [webmaild] 149.86.137.117 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.9
description:
[2025-01-28 14:29:55 +0100] info [webmaild] 84.54.71.9 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 14:30:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.113.45
description:
47.128.113.45 - - [28/Jan/2025:14:30:36 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180761 HTTP/2.0" 302 0 mail.ait-edu.us "https://mail.ait-edu.us/?__im-NEUGDYWI=10142846288597844955" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.113.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.67
description:
2025-01-28 14:31:52 dovecot_plain authenticator failed for ([106.246.89.67]) [106.246.89.67]:58976: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.11.36
description:
Jan 28 14:31:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.11.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.11.36
description:
2025-01-28 14:31:27 dovecot_plain authenticator failed for ([59.8.11.36]) [59.8.11.36]:38550: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.206.255.22
description:
[2025-01-28 14:31:32 +0100] info [webmaild] 186.206.255.22 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.67
description:
Jan 28 14:31:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 14:33:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.210.134.9
description:
2025-01-28 14:32:25 dovecot_plain authenticator failed for ([221.210.134.9]) [221.210.134.9]:50108: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-01-28 14:32:36 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:34988: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 14:32:51 ait sshd[3692162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 14:32:51 ait sshd[3692162]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.210.134.9
description:
Jan 28 14:32:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.210.134.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.156.166.138
description:
[2025-01-28 14:32:31 +0100] info [webmaild] 94.156.166.138 - rfiawoo13@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Jan 28 14:32:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.156.166.138
description:
[2025-01-28 14:33:25 +0100] info [webmaild] 94.156.166.138 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 14:33:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
description:
Jan 28 14:34:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 28 14:35:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-28 14:35:08 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:51025: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.85.132
description:
[2025-01-28 14:35:13 +0100] info [webmaild] 179.0.85.132 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Jan 28 14:35:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-01-28 14:35:19 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:41542: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.156.166.138
description:
[2025-01-28 14:34:36 +0100] info [whostmgrd] 94.156.166.138 - rfiawoo13 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
description:
2025-01-28 14:34:57 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:36059: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.172.162.209
description:
[2025-01-28 14:36:00 +0100] info [webmaild] 38.172.162.209 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 28 14:36:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 14:37:01 dovecot_plain authenticator failed for (primple) [46.30.161.197]:33349: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.179.238
description:
[2025-01-28 14:37:03 +0100] info [webmaild] 45.173.179.238 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.117.186
description:
2025-01-28 14:37:08 dovecot_plain authenticator failed for ([60.219.117.186]) [60.219.117.186]:37763: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.211.103.220
description:
[2025-01-28 14:37:11 +0100] info [webmaild] 186.211.103.220 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 28 14:36:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
description:
2025-01-28 14:36:50 dovecot_plain authenticator failed for ([110.189.153.136]) [110.189.153.136]:58949: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.128.123.34
description:
Jan 28 14:37:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.128.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Jan 28 14:36:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 14:36:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.117.186
description:
Jan 28 14:37:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.117.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.116.224.206
description:
[2025-01-28 14:36:56 +0100] info [webmaild] 177.116.224.206 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.63.180.167
description:
Jan 28 14:37:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.63.180.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.7
description:
[2025-01-28 14:38:14 +0100] info [whostmgrd] 156.228.104.7 - ads19b00191y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.142
description:
Jan 28 14:37:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.77.107
description:
[2025-01-28 14:37:57 +0100] info [webmaild] 181.46.77.107 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.128.125
description:
[2025-01-28 14:38:07 +0100] info [webmaild] 190.89.128.125 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.63
description:
[2025-01-28 14:38:12 +0100] info [whostmgrd] 104.207.60.63 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.166
description:
[2025-01-28 14:38:13 +0100] info [whostmgrd] 156.228.101.166 - ads19b00191y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.41
description:
[2025-01-28 14:38:13 +0100] info [whostmgrd] 104.207.63.41 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.34.156
description:
[2025-01-28 14:38:14 +0100] info [whostmgrd] 104.207.34.156 - ads19b00191y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.167.160
description:
[2025-01-28 14:37:47 +0100] info [webmaild] 177.222.167.160 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.10
description:
[2025-01-28 14:38:10 +0100] info [cpaneld] 156.228.114.10 - ads19b00191y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19b00191y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.55
description:
[2025-01-28 14:38:11 +0100] info [cpaneld] 104.207.41.55 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.132
description:
[2025-01-28 14:38:11 +0100] info [cpaneld] 104.207.49.132 - ads19b00191y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19b00191y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.10
description:
[2025-01-28 14:38:14 +0100] info [whostmgrd] 156.228.87.10 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.89.186
description:
[2025-01-28 14:39:06 +0100] info [webmaild] 103.135.89.186 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.10.31.112
description:
[2025-01-28 14:39:07 +0100] info [webmaild] 103.10.31.112 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Jan 28 14:39:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-01-28 14:39:10 dovecot_plain authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:49916: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 14:39:30 ait sshd[3695736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 28 14:39:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.191
description:
2025-01-28 14:39:35 dovecot_plain authenticator failed for 111-70-32-191.emome-ip.hinet.net [111.70.32.191]:49445: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-28 14:39:36 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:51127: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 14:39:47 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:54284: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 28 14:39:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.208.123.101
description:
[2025-01-28 14:39:49 +0100] info [webmaild] 186.208.123.101 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.27.158.165
description:
2025-01-28 14:39:50 dovecot_plain authenticator failed for host-87-27-158-165.business.telecomitalia.it [87.27.158.165]:41467: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-28 14:39:51 dovecot_plain authenticator failed for (dented) [65.20.143.159]:37790: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 14:39:30 ait sshd[3695736]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.27.158.165
description:
Jan 28 14:39:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.27.158.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.34.169.27
description:
[2025-01-28 14:40:47 +0100] info [webmaild] 177.34.169.27 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.51.142.221
description:
[2025-01-28 14:40:52 +0100] info [webmaild] 179.51.142.221 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-01-28 14:41:10 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:22736: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-28 14:41:17 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:44827: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
description:
2025-01-28 14:40:34 dovecot_plain authenticator failed for (dardacorta) [65.20.233.110]:42949: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Jan 28 14:41:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 28 14:41:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
description:
Jan 28 14:40:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Jan 28 14:41:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.107.234
description:
[2025-01-28 14:41:52 +0100] info [cpaneld] 156.228.107.234 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.178
description:
[2025-01-28 14:41:54 +0100] info [whostmgrd] 156.228.89.178 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.48
description:
[2025-01-28 14:41:54 +0100] info [whostmgrd] 104.207.35.48 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.235
description:
[2025-01-28 14:41:55 +0100] info [whostmgrd] 156.228.98.235 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.81
description:
[2025-01-28 14:41:56 +0100] info [whostmgrd] 156.228.85.81 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-01-28 14:41:57 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:57764: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-28 14:41:41 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:39540: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.34.126
description:
[2025-01-28 14:41:47 +0100] info [cpaneld] 104.207.34.126 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.86.200
description:
[2025-01-28 14:41:55 +0100] info [whostmgrd] 156.228.86.200 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.118
description:
[2025-01-28 14:41:47 +0100] info [cpaneld] 104.207.40.118 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00014y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Jan 28 14:41:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.22.171
description:
[2025-01-28 14:42:09 +0100] info [webmaild] 45.70.22.171 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.189
description:
[2025-01-28 14:41:53 +0100] info [cpaneld] 156.228.84.189 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00014y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.42
description:
[2025-01-28 14:41:53 +0100] info [cpaneld] 104.207.58.42 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00014y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.130
description:
[2025-01-28 14:41:54 +0100] info [whostmgrd] 104.207.47.130 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 28 14:43:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 28 14:43:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Jan 28 14:42:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Jan 28 14:42:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 28 14:42:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-01-28 14:42:58 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:55093: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-28 14:43:00 dovecot_plain authenticator failed for (datalle) [77.51.214.170]:39339: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-01-28 14:42:48 dovecot_plain authenticator failed for ([41.59.228.160]) [41.59.228.160]:33918: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-28 14:43:02 dovecot_plain authenticator failed for net-93-149-50-114.cust.vodafonedsl.it (iorpharly) [93.149.50.114]:51238: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.37
description:
Jan 28 14:44:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-01-28 14:43:48 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:33791: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
description:
2025-01-28 14:43:56 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:36944: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
description:
Jan 28 14:43:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.37
description:
2025-01-28 14:44:06 dovecot_plain authenticator failed for (m121-202-206-37.smartone.com) [121.202.206.37]:3697: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 28 14:43:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Jan 28 14:43:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.245.96
description:
[2025-01-28 14:43:49 +0100] info [webmaild] 138.0.245.96 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 14:44:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
description:
2025-01-28 14:44:32 dovecot_plain authenticator failed for ([197.156.115.37]) [197.156.115.37]:51576: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
description:
Jan 28 14:44:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Jan 28 14:44:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-01-28 14:44:40 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:53976: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-01-28 14:44:52 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:56878: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Jan 28 14:44:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.15.16.101
description:
[2025-01-28 14:46:30 +0100] info [webmaild] 187.15.16.101 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 28 14:48:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.209.196.225
description:
[2025-01-28 14:47:42 +0100] info [webmaild] 185.209.196.225 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-28 14:48:13 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:28742: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 14:48:31 ait sshd[3700751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 28 14:48:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-28 14:48:33 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:42248: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.209.196.225
description:
[2025-01-28 14:48:40 +0100] info [webmaild] 185.209.196.225 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
description:
2025-01-28 14:48:50 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:41126: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-01-28 14:49:07 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:52810: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 14:48:31 ait sshd[3700751]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.68.67
description:
[2025-01-28 14:48:37 +0100] info [webmaild] 45.172.68.67 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
description:
Jan 28 14:48:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.49.61.211
description:
Jan 28 14:48:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.49.61.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-01-28 14:48:58 dovecot_plain authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:53414: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.235.167.194
description:
[2025-01-28 14:49:13 +0100] info [webmaild] 201.235.167.194 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 28 14:48:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-28 14:48:28 dovecot_plain authenticator failed for (exatioxy) [185.65.238.250]:51215: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
description:
2025-01-28 14:48:43 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:56076: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Jan 28 14:48:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Jan 28 14:49:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.27.218.88
description:
[2025-01-28 14:49:23 +0100] info [webmaild] 186.27.218.88 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 28 14:50:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Jan 28 14:49:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.117.13.77
description:
[2025-01-28 14:49:24 +0100] info [webmaild] 196.117.13.77 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-01-28 14:49:24 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:36691: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-28 14:50:06 dovecot_plain authenticator failed for (wathono) [62.231.31.86]:55174: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-01-28 14:51:42 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:52230: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.155.39.180
description:
[2025-01-28 14:51:44 +0100] info [webmaild] 105.155.39.180 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.96.11.230
description:
Jan 28 14:51:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.96.11.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.96.11.230
description:
2025-01-28 14:51:54 dovecot_plain authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:55899: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.31.36
description:
[2025-01-28 14:52:12 +0100] info [webmaild] 190.89.31.36 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.175.48.5
description:
Jan 28 14:51:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.175.48.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.175.48.5
description:
2025-01-28 14:51:35 dovecot_plain authenticator failed for ([39.175.48.5]) [39.175.48.5]:4209: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Jan 28 14:51:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.110.195
description:
[2025-01-28 14:53:07 +0100] info [webmaild] 138.186.110.195 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 14:53:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.228.52
description:
[2025-01-28 14:52:28 +0100] info [webmaild] 177.8.228.52 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 14:53:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 14:54:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 28 14:55:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Jan 28 14:54:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.190.18.212
description:
[2025-01-28 14:54:42 +0100] info [webmaild] 187.190.18.212 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.123.72.205
description:
Jan 28 14:54:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.123.72.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.123.72.205
description:
2025-01-28 14:54:57 dovecot_plain authenticator failed for ([187.123.72.205]) [187.123.72.205]:48833: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-28 14:55:21 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:45672: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-01-28 14:54:44 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:40418: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 14:55:39 ait sshd[3704771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.46.236.195
description:
[2025-01-28 14:56:20 +0100] info [webmaild] 94.46.236.195 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 14:55:39 ait sshd[3704771]: Invalid user shield-project.ru 2a03 from 122.51.104.242 port 35920


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 14:55:39 ait sshd[3704771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 14:55:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 14:56:24 ait sshd[3705138]: Invalid user shield-project.ru 2a03 from 122.51.104.242 port 52238


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 14:56:24 ait sshd[3705138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 14:56:24 ait sshd[3705138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 14:56:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 14:57:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 14:57:10 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ackerrited) [87.103.126.54]:26288: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 14:58:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.38.26.228
description:
[2025-01-28 14:58:08 +0100] info [webmaild] 92.38.26.228 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 69.30.195.178
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:14-58.69.30.195.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 14:59:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 15:00:36 ait sshd[3707402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.252
description:
Jan 28 15:01:09 ait sshd[3707578]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 15:00:36 ait sshd[3707402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.140.135.28
description:
[2025-01-28 15:00:41 +0100] info [webmaild] 94.140.135.28 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-00.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.252
description:
Jan 28 15:01:09 ait sshd[3707578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.252  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 15:01:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Jan 28 15:01:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.232.73.77
description:
[2025-01-28 15:01:33 +0100] info [webmaild] 45.232.73.77 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-28 15:01:36 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:54734: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.57.125
description:
Jan 28 15:01:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.57.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
description:
2025-01-28 15:01:25 dovecot_plain authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:41864: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.228.130.223
description:
[2025-01-28 15:01:45 +0100] info [webmaild] 179.228.130.223 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.37.113.210
description:
[2025-01-28 15:01:46 +0100] info [webmaild] 5.37.113.210 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.89
description:
[2025-01-28 15:02:31 +0100] info [webmaild] 213.230.93.89 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 15:03:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.43.85
description:
[2025-01-28 15:03:04 +0100] info [webmaild] 138.59.43.85 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 15:03:04 dovecot_plain authenticator failed for (shagesilly) [46.30.161.197]:54209: 535 Incorrect authentication data (set_id=info@aitedu.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.35.161.14
description:
[2025-01-28 15:02:50 +0100] info [webmaild] 212.35.161.14 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.20.28.102
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:awadzie@ait.edu.gh||WPU:awadzie@ait.edu.gh||RSV:6.65||T:APACHE||MV:15-03.178.20.28.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.118.49
description:
[2025-01-28 15:03:48 +0100] info [webmaild] 131.161.118.49 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.236.194.93
description:
[2025-01-28 15:04:10 +0100] info [webmaild] 190.236.194.93 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.0.77
description:
[2025-01-28 15:03:37 +0100] info [webmaild] 177.93.0.77 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 15:04:10 ait sshd[3709275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 15:04:10 ait sshd[3709275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
description:
Jan 28 15:05:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
description:
2025-01-28 15:05:14 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:34504: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.228.81
description:
[2025-01-28 15:04:54 +0100] info [webmaild] 37.236.228.81 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 15:04:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-01-28 15:05:31 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:58155: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-28 15:05:55 dovecot_plain authenticator failed for 9498.telnet.bg (geablemet) [87.254.165.100]:33886: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 15:06:21 ait sshd[3710620]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 15:06:21 ait sshd[3710620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 15:05:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.138.165.138
description:
[2025-01-28 15:05:28 +0100] info [webmaild] 103.138.165.138 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Jan 28 15:05:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 28 15:05:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 15:06:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 109.123.241.227
domain: elibrary.ait-edu.us
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/null/pgon.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 15:07:00 ait sshd[3710978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 28 15:06:40 ait sshd[3710717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 28 15:06:40 ait sshd[3710717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.76.38.184
description:
[2025-01-28 15:07:02 +0100] info [webmaild] 179.76.38.184 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.45.34.127
description:
Jan 28 15:06:23 ait sshd[3710620]: Failed password for invalid user ait from 31.45.34.127 port 59214 ssh2


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 213.232.87.228
domain: smartsis.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:aitext01||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 15:07:00 ait sshd[3710978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-01-28 15:08:46 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:37228: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-01-28 15:08:56 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:58416: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.189.90.7
description:
[2025-01-28 15:08:53 +0100] info [webmaild] 186.189.90.7 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.208
description:
Jan 28 15:09:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Jan 28 15:08:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Jan 28 15:08:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
description:
2025-01-28 15:09:16 dovecot_plain authenticator failed for (roper) [154.144.255.208]:33668: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 15:09:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
description:
Jan 28 15:09:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.197.38
description:
Jan 28 15:09:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
description:
2025-01-28 15:09:56 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:50934: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.251.129.47
description:
[2025-01-28 15:09:29 +0100] info [webmaild] 186.251.129.47 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.197.38
description:
2025-01-28 15:09:44 dovecot_plain authenticator failed for ([166.195.197.38]) [166.195.197.38]:60276: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.110.127.224
description:
Jan 28 15:10:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.110.127.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 28 15:11:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 15:10:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.20.8.25
description:
Jan 28 15:11:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.20.8.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.20.8.25
description:
2025-01-28 15:11:11 dovecot_plain authenticator failed for ([5.20.8.25]) [5.20.8.25]:43926: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Jan 28 15:11:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-28 15:11:20 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:51504: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-01-28 15:11:22 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:32790: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.110.127.224
description:
2025-01-28 15:10:57 dovecot_plain authenticator failed for ([183.71.251.66]) [14.110.127.224]:37481: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 15:12:12 dovecot_plain authenticator failed for (sated) [147.235.97.158]:23177: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Jan 28 15:12:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-01-28 15:12:15 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (ogral) [188.127.16.197]:37902: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Jan 28 15:11:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-01-28 15:11:50 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:60246: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
description:
Jan 28 15:11:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 15:12:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
description:
2025-01-28 15:12:00 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:39458: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.154.251
description:
[2025-01-28 15:12:59 +0100] info [webmaild] 186.225.154.251 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.155.188.110
description:
[2025-01-28 15:14:06 +0100] info [webmaild] 177.155.188.110 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.128.219.132
description:
[2025-01-28 15:14:12 +0100] info [webmaild] 190.128.219.132 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
description:
Jan 28 15:14:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
description:
2025-01-28 15:14:21 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:39618: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.178.72.144
description:
[2025-01-28 15:13:59 +0100] info [webmaild] 179.178.72.144 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
description:
2025-01-28 15:13:58 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:42402: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 28 15:14:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
description:
Jan 28 15:13:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.44
description:
2025-01-28 15:14:37 dovecot_plain authenticator failed for 110-25-107-44.adsl.fetnet.net [110.25.107.44]:59676: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.26.86.216
description:
[2025-01-28 15:14:58 +0100] info [webmaild] 103.26.86.216 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.175.234.124
description:
[2025-01-28 15:15:07 +0100] info [webmaild] 78.175.234.124 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


