# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Jan 29 14:49:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.161.140.54
description:
Jan 29 14:49:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.161.140.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
description:
2025-01-29 14:49:38 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:58788: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
description:
Jan 29 14:49:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.211.155
description:
2025-01-29 14:49:22 dovecot_plain authenticator failed for p383156-obmd01.tokyo.ocn.ne.jp [60.38.211.155]:42139: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.98.114.27
description:
[2025-01-29 14:51:14 +0100] info [webmaild] 79.98.114.27 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 14:50:21 ait sshd[215345]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 14:50:21 ait sshd[215345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.83.129.115
description:
[2025-01-29 14:52:10 +0100] info [webmaild] 95.83.129.115 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-01-29 14:51:30 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:42496: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
description:
2025-01-29 14:51:42 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:47956: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
description:
Jan 29 14:51:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 175.29.193.73
description:
[2025-01-29 14:51:47 +0100] info [webmaild] 175.29.193.73 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 14:51:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Jan 29 14:51:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.148.253
description:
[2025-01-29 14:52:20 +0100] info [webmaild] 5.62.148.253 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.218.226.21
description:
[2025-01-29 14:53:16 +0100] info [webmaild] 103.218.226.21 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.36.129.67
description:
[2025-01-29 14:53:51 +0100] info [webmaild] 92.36.129.67 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.64.120
description:
[2025-01-29 14:54:01 +0100] info [webmaild] 138.0.64.120 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.188.191
description:
[2025-01-29 14:53:19 +0100] info [webmaild] 187.84.188.191 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 14:55:06 ait sshd[218606]: Invalid user responsivetemplates.nl 2001 from 111.231.56.128 port 44274


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 14:55:06 ait sshd[218606]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 14:55:06 ait sshd[218606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 29 14:55:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
description:
Jan 29 14:55:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.55
description:
[2025-01-29 14:56:10 +0100] info [webmaild] 213.230.93.55 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-29 14:55:30 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:53014: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
description:
2025-01-29 14:55:40 dovecot_plain authenticator failed for ([123.129.245.249]) [123.129.245.249]:33754: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 29 14:56:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-29 14:56:34 dovecot_plain authenticator failed for (likersarse) [102.53.15.17]:35462: 535 Incorrect authentication data (set_id=nanette.huggins@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Jan 29 14:56:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.137.67.106
description:
[2025-01-29 14:57:08 +0100] info [webmaild] 103.137.67.106 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 146.70.103.20
description:
[2025-01-29 14:57:13 +0100] info [cpaneld] 146.70.103.20 - lemsas "GET /cpsess8783662606/frontend/jupiter/index.html?=undefined&login=1&post_login=80672169457564 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [146.70.103.9] != Current IP Address [146.70.103.20]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 146.70.103.18
description:
[2025-01-29 14:56:52 +0100] info [cpaneld] 146.70.103.18 - lemsas "GET /cpsess7190995042/?=undefined&login=1&post_login=80672169457564 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [146.70.103.14] != Current IP Address [146.70.103.18]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-01-29 14:56:59 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:41983: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 14:56:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-29 14:57:36 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:36785: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.20.128.218
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:14-57.51.20.128.218


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 14:57:28 ait sshd[220244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 29 14:57:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.56
description:
[2025-01-29 14:57:54 +0100] info [webmaild] 213.230.86.56 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 14:57:28 ait sshd[220244]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 14:58:48 ait sshd[221039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-58.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-29 14:59:16 dovecot_plain authenticator failed for (189-57-233-32.customer.tdatabrasil.net.br) [186.238.43.146]:58836: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 14:58:48 ait sshd[221039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 29 14:59:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 29 14:59:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-29 14:59:28 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:47560: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.141.40
description:
[2025-01-29 14:59:29 +0100] info [webmaild] 41.56.141.40 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 15:00:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.224.58
description:
[2025-01-29 15:00:32 +0100] info [webmaild] 177.55.224.58 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.159.74.129
description:
[2025-01-29 15:00:53 +0100] info [webmaild] 45.159.74.129 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.216.96
description:
[2025-01-29 15:00:24 +0100] info [webmaild] 45.186.216.96 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 15:02:17 ait sshd[223797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 15:02:17 ait sshd[223797]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.58.136.167
description:
Jan 29 15:01:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.58.136.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.117.84
description:
Jan 29 15:01:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.117.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.117.84
description:
2025-01-29 15:01:47 dovecot_plain authenticator failed for ([165.90.117.84]) [165.90.117.84]:34457: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.136.167
description:
2025-01-29 15:01:40 dovecot_plain authenticator failed for ([2.58.136.167]) [2.58.136.167]:2502: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.80.105.52
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads21b00213y@ait.edu.gh||WPU:ads21b00213y@ait.edu.gh||RSV:6.65||T:APACHE||MV:15-02.45.80.105.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.142.155.136
description:
[2025-01-29 15:02:31 +0100] info [webmaild] 190.142.155.136 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.206.255.14
description:
[2025-01-29 15:03:10 +0100] info [webmaild] 186.206.255.14 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 15:03:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-01-29 15:03:48 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:50445: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.200.45
description:
[2025-01-29 15:04:10 +0100] info [webmaild] 45.4.200.45 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 29 15:03:29 ait sshd[224365]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 29 15:03:29 ait sshd[224365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Jan 29 15:03:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-01-29 15:03:46 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:45163: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-29 15:03:58 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:64518: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.82.175.68
description:
[2025-01-29 15:04:19 +0100] info [webmaild] 189.82.175.68 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.190.243
description:
2025-01-29 15:03:33 dovecot_plain authenticator failed for ([221.162.190.243]) [221.162.190.243]:48803: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Jan 29 15:03:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 29 15:03:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.190.243
description:
Jan 29 15:03:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.190.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 29 15:05:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 15:04:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.81.76.132
description:
[2025-01-29 15:05:11 +0100] info [webmaild] 177.81.76.132 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-29 15:05:16 dovecot_plain authenticator failed for ([223.241.100.90]) [223.241.100.90]:35108: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 29 15:05:26 ait sshd[225317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 29 15:05:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-29 15:05:48 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:60378: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 29 15:05:26 ait sshd[225317]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.28
description:
[2025-01-29 15:05:29 +0100] info [webmaild] 213.230.86.28 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.126.124
description:
[2025-01-29 15:06:10 +0100] info [webmaild] 143.202.126.124 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.207.124.113
description:
[2025-01-29 15:06:12 +0100] info [webmaild] 109.207.124.113 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Jan 29 15:07:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 29 15:07:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-29 15:07:47 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (sinis) [83.254.126.238]:44382: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.161.249
description:
[2025-01-29 15:07:56 +0100] info [webmaild] 45.186.161.249 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.100.70
description:
[2025-01-29 15:08:01 +0100] info [webmaild] 213.230.100.70 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 15:08:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.166.2
description:
2025-01-29 15:10:03 dovecot_plain authenticator failed for ([183.237.166.2]) [183.237.166.2]:34223: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Jan 29 15:10:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-01-29 15:10:13 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:59628: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.94.146.126
description:
[2025-01-29 15:09:39 +0100] info [webmaild] 187.94.146.126 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.166.2
description:
Jan 29 15:10:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 15:11:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Jan 29 15:11:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.210.208.164
description:
[2025-01-29 15:11:25 +0100] info [webmaild] 37.210.208.164 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-01-29 15:12:00 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:50552: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 15:12:38 ait sshd[229698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.165
description:
Jan 29 15:12:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 29 15:12:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.157.130.83
description:
Jan 29 15:13:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.157.130.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-01-29 15:13:08 dovecot_plain authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:53233: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
description:
2025-01-29 15:12:21 dovecot_plain authenticator failed for ([58.18.64.54]) [58.18.64.54]:38652: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.189.188.240
description:
[2025-01-29 15:12:59 +0100] info [webmaild] 187.189.188.240 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 29 15:12:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-29 15:12:54 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:58001: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Jan 29 15:13:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-29 15:12:29 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:33220: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 15:12:37 ait sshd[229698]: Invalid user responsivetemplates.nl 2001 from 111.231.56.128 port 32972


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 15:12:38 ait sshd[229698]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.165
description:
2025-01-29 15:12:47 dovecot_plain authenticator failed for ([27.40.100.165]) [27.40.100.165]:40238: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-29 15:12:57 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:46648: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.130.83
description:
2025-01-29 15:13:09 dovecot_plain authenticator failed for ([218.157.130.83]) [218.157.130.83]:42925: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
description:
Jan 29 15:12:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 29 15:12:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.209.185.43
description:
[2025-01-29 15:12:28 +0100] info [webmaild] 179.209.185.43 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.49
description:
[2025-01-29 15:12:39 +0100] info [webmaild] 213.230.93.49 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
description:
Jan 29 15:13:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-01-29 15:13:20 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:36974: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
description:
Jan 29 15:13:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.129.14
description:
[2025-01-29 15:13:37 +0100] info [webmaild] 177.85.129.14 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
description:
2025-01-29 15:13:37 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:52582: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 15:14:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 15:14:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 58.65.222.86
description:
[2025-01-29 15:15:15 +0100] info [webmaild] 58.65.222.86 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-29 15:15:31 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:46800: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-29 15:15:32 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:44748: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 82.215.96.78
description:
[2025-01-29 15:16:13 +0100] info [webmaild] 82.215.96.78 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Jan 29 15:15:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
description:
2025-01-29 15:15:43 dovecot_plain authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:54053: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.193.147
description:
Jan 29 15:16:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.193.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-29 15:16:11 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:51905: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-29 15:15:22 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:57570: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.58
description:
Jan 29 15:15:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 29 15:15:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 29 15:15:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.209.193.147
description:
2025-01-29 15:16:02 dovecot_plain authenticator failed for ([186.209.193.147]) [186.209.193.147]:54818: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 29 15:16:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.230.127.224
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-16.213.230.127.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.215.248.92
description:
[2025-01-29 15:17:14 +0100] info [webmaild] 200.215.248.92 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 29 15:16:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-29 15:16:22 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:14432: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.202.100.231
description:
[2025-01-29 15:16:28 +0100] info [webmaild] 176.202.100.231 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.208.138
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-16.173.212.208.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 29 15:17:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.203.86.207
description:
Jan 29 15:18:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.203.86.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.135.19.164
description:
[2025-01-29 15:17:37 +0100] info [webmaild] 178.135.19.164 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-29 15:17:46 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:57498: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
description:
2025-01-29 15:18:08 dovecot_plain authenticator failed for ([74.203.86.207]) [74.203.86.207]:59610: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.208.42.125
description:
[2025-01-29 15:18:16 +0100] info [webmaild] 195.208.42.125 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.156.109.142
description:
[2025-01-29 15:18:25 +0100] info [webmaild] 102.156.109.142 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.209.181.65
description:
[2025-01-29 15:19:01 +0100] info [webmaild] 102.209.181.65 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.8.174.96
description:
[2025-01-29 15:19:46 +0100] info [webmaild] 190.8.174.96 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.195.250
description:
Jan 29 15:19:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.195.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.40.203
description:
2025-01-29 15:21:47 dovecot_plain authenticator failed for ([120.238.40.203]) [120.238.40.203]:53516: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-29 15:21:55 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:29437: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
description:
Jan 29 15:21:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.40.203
description:
Jan 29 15:21:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.40.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.190.228.152
description:
[2025-01-29 15:21:53 +0100] info [webmaild] 103.190.228.152 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 29 15:21:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-29 15:21:58 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:60944: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
description:
2025-01-29 15:21:44 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:42989: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 29 15:21:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
description:
Jan 29 15:22:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.182.73.132
description:
2025-01-29 15:22:24 dovecot_plain authenticator failed for ([210.182.73.132]) [210.182.73.132]:12663: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.132
description:
Jan 29 15:22:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
description:
2025-01-29 15:22:41 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:50550: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 15:23:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 15:23:42 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:39954: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 15:23:46 ait sshd[235070]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 15:23:46 ait sshd[235070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.194.237
description:
[2025-01-29 15:24:22 +0100] info [webmaild] 177.37.194.237 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 29 15:24:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-29 15:25:01 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:55946: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.183
description:
Jan 29 15:25:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
description:
2025-01-29 15:25:09 dovecot_plain authenticator failed for ([195.222.57.183]) [195.222.57.183]:43526: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.1.230
description:
[2025-01-29 15:25:45 +0100] info [webmaild] 169.224.1.230 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 15:25:24 ait sshd[235954]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 15:25:24 ait sshd[235954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.166.173.226
description:
[2025-01-29 15:25:31 +0100] info [webmaild] 103.166.173.226 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.156.121.209
description:
[2025-01-29 15:25:42 +0100] info [webmaild] 177.156.121.209 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Jan 29 15:26:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-01-29 15:26:53 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:40930: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.30.109.46
description:
[2025-01-29 15:26:37 +0100] info [webmaild] 177.30.109.46 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Jan 29 15:26:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-01-29 15:26:40 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:51812: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 29 15:28:07 ait sshd[237578]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 29 15:28:07 ait sshd[237578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 15:28:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.115.131.101
description:
[2025-01-29 15:29:15 +0100] info [webmaild] 191.115.131.101 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 15:29:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-01-29 15:29:45 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:43773: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.39.166
description:
Jan 29 15:29:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.39.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Jan 29 15:29:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.39.166
description:
2025-01-29 15:29:56 dovecot_plain authenticator failed for ([60.28.39.166]) [60.28.39.166]:40978: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.68.113.219
description:
[2025-01-29 15:30:09 +0100] info [webmaild] 41.68.113.219 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 15:30:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 15:31:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.94
description:
47.128.50.94 - - [29/Jan/2025:15:30:41 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11011812 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=30%2C205%2C61%2C106&filter_course-language=198&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 106.0.53.114
description:
[2025-01-29 15:30:42 +0100] info [webmaild] 106.0.53.114 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 15:30:46 ait sshd[239194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.99.132.136
description:
[2025-01-29 15:31:26 +0100] info [webmaild] 179.99.132.136 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 15:30:46 ait sshd[239194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.151.28
description:
Jan 29 15:30:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.151.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.71.120.225
description:
[2025-01-29 15:32:21 +0100] info [webmaild] 200.71.120.225 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 172.104.187.239
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-32.172.104.187.239


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 148.101.4.45
description:
[2025-01-29 15:31:38 +0100] info [webmaild] 148.101.4.45 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.121.163.54
description:
[2025-01-29 15:31:57 +0100] info [webmaild] 187.121.163.54 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.167.29
description:
[2025-01-29 15:32:18 +0100] info [webmaild] 45.70.167.29 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.17.116
description:
47.128.17.116 - - [29/Jan/2025:15:33:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13670182 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C205&filter_course-language=198%2C79%2C120%2C118%2C121%2C183&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.148.181
description:
[2025-01-29 15:33:29 +0100] info [webmaild] 5.62.148.181 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-32.147.135.223.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 15:35:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.25.253.163
description:
[2025-01-29 15:35:18 +0100] info [webmaild] 223.25.253.163 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 15:35:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-29 15:36:05 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:53578: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-01-29 15:36:18 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:52194: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 15:35:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.53.141
description:
47.128.53.141 - - [29/Jan/2025:15:36:15 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29450004 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=803" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.53.141


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-29 15:35:54 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:37912: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-35.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 29 15:35:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 29 15:36:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-29 15:36:26 dovecot_plain authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:46248: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 29 15:36:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Jan 29 15:36:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-29 15:36:57 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:53244: 535 Incorrect authentication data (set_id=masomani)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.19.44.207
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:mappiah@ait.edu.gh||WPU:mappiah@ait.edu.gh||RSV:6.65||T:APACHE||MV:15-37.146.19.44.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.255.54
description:
2025-01-29 15:36:41 dovecot_plain authenticator failed for ([220.179.255.54]) [220.179.255.54]:46455: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 29 15:36:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
description:
2025-01-29 15:37:06 dovecot_plain authenticator failed for ([111.39.167.59]) [111.39.167.59]:38483: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.219.132.135
description:
[2025-01-29 15:37:25 +0100] info [webmaild] 46.219.132.135 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
description:
Jan 29 15:37:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
description:
Jan 29 15:36:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.167.59
description:
Jan 29 15:37:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.167.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
description:
2025-01-29 15:37:19 dovecot_plain authenticator failed for ([222.235.82.88]) [222.235.82.88]:33096: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.248.104.220
description:
[2025-01-29 15:37:49 +0100] info [webmaild] 62.248.104.220 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.155.105.223
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-38.104.155.105.223


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.75.161.33
description:
Jan 29 15:38:34 ait sshd[242858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.161.33


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.161.33
description:
Jan 29 15:38:34 ait sshd[242858]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.75.161.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.35.211
description:
Jan 29 15:39:21 ait sshd[243476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.35.211


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.155.105.223
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-39.104.155.105.223


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.157.205.48
description:
[2025-01-29 15:38:45 +0100] info [webmaild] 105.157.205.48 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-39.104.209.253.237


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.161.33
description:
Jan 29 15:38:37 ait sshd[242858]: Failed password for invalid user user from 51.75.161.33 port 50136 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.98.188.24
description:
[2025-01-29 15:38:45 +0100] info [webmaild] 189.98.188.24 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.35.211
description:
Jan 29 15:39:21 ait sshd[243476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 15:39:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-01-29 15:40:00 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:47805: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-01-29 15:40:12 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:52771: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.30.80
description:
[2025-01-29 15:40:05 +0100] info [webmaild] 103.151.30.80 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
description:
Jan 29 15:40:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 15:39:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Jan 29 15:39:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.125.126
description:
47.128.125.126 - - [29/Jan/2025:15:40:24 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=1880589 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?duration=short%2Cmedium%2Clong&filtering=1&level=intermediate%2Cbeginner%2Cexpert%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.125.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
description:
2025-01-29 15:41:32 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:35903: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 15:40:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
description:
Jan 29 15:41:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Jan 29 15:41:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Jan 29 15:41:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.75.161.33
description:
Jan 29 15:40:51 ait sshd[245128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.161.33


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-29 15:41:24 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:37540: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.45.47
description:
[2025-01-29 15:41:32 +0100] info [webmaild] 45.171.45.47 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.161.33
description:
Jan 29 15:40:51 ait sshd[245128]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.75.161.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.75.161.33
description:
Jan 29 15:41:59 ait sshd[246126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.161.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
description:
Jan 29 15:42:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.251.219.209
description:
Jan 29 15:41:38 ait sshd[245681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.251.219.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
description:
2025-01-29 15:42:17 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:35805: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.251.219.209
description:
Jan 29 15:41:38 ait sshd[245681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.251.219.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Jan 29 15:42:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-29 15:41:43 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:49272: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.161.33
description:
Jan 29 15:41:59 ait sshd[246126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.75.161.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-01-29 15:42:05 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:53337: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 29 15:41:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.161.33
description:
Jan 29 15:42:01 ait sshd[246126]: Failed password for invalid user user1 from 51.75.161.33 port 55178 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 145.255.168.154
description:
[2025-01-29 15:42:35 +0100] info [webmaild] 145.255.168.154 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-01-29 15:41:37 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:57986: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 15:43:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.237.209
description:
[2025-01-29 15:43:06 +0100] info [webmaild] 45.161.237.209 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.251.219.209
description:
Jan 29 15:43:08 ait sshd[246707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.251.219.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Jan 29 15:43:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.51.119.252
description:
[2025-01-29 15:42:52 +0100] info [webmaild] 179.51.119.252 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.251.219.209
description:
Jan 29 15:43:08 ait sshd[246707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.251.219.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 15:44:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.251.219.209
description:
Jan 29 15:44:29 ait sshd[247251]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.251.219.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 15:43:50 ait sshd[246899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 15:43:50 ait sshd[246899]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 15:43:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.24
description:
[2025-01-29 15:43:52 +0100] info [webmaild] 84.54.71.24 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.251.219.209
description:
Jan 29 15:44:29 ait sshd[247251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.251.219.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.173.61.241
description:
[2025-01-29 15:43:38 +0100] info [webmaild] 103.173.61.241 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.89.179.90
description:
[2025-01-29 15:44:37 +0100] info [webmaild] 189.89.179.90 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-29 15:45:14 dovecot_plain authenticator failed for (telys) [65.20.183.209]:59350: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
description:
2025-01-29 15:44:59 dovecot_plain authenticator failed for ([58.115.53.66]) [58.115.53.66]:34884: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 29 15:45:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.35.211
description:
Jan 29 15:45:26 ait sshd[248008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 15:45:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-01-29 15:45:20 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:43842: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.76.146.189
description:
[2025-01-29 15:44:56 +0100] info [webmaild] 5.76.146.189 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Jan 29 15:45:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
description:
Jan 29 15:44:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.35.211
description:
Jan 29 15:45:26 ait sshd[248008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.35.211


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 15:45:48 ait sshd[248328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
description:
2025-01-29 15:46:04 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:58072: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 15:45:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
description:
Jan 29 15:45:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
description:
2025-01-29 15:45:47 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:39610: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Jan 29 15:46:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 111.88.16.210
description:
[2025-01-29 15:45:38 +0100] info [webmaild] 111.88.16.210 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 15:45:48 ait sshd[248328]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.208.40.95
description:
[2025-01-29 15:47:26 +0100] info [webmaild] 154.208.40.95 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 15:47:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 15:48:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.189.122.139
description:
2025-01-29 15:48:50 dovecot_plain authenticator failed for wsip-184-189-122-139.oc.oc.cox.net [184.189.122.139]:48794: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 29 15:49:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-01-29 15:49:03 dovecot_plain authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:11479: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-29 15:48:37 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (gealenize) [51.255.84.180]:45800: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.236.44.15
description:
[2025-01-29 15:48:43 +0100] info [webmaild] 109.236.44.15 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.189.122.139
description:
Jan 29 15:48:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.189.122.139 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 15:50:01 ait sshd[250336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 15:50:10 ait sshd[250673]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 15:50:01 ait sshd[250336]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 15:50:10 ait sshd[250673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 29 15:50:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.90.67
description:
[2025-01-29 15:49:57 +0100] info [webmaild] 37.40.90.67 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.135.8
description:
Jan 29 15:50:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.135.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.3.140.34
description:
2025-01-29 15:51:25 dovecot_plain authenticator failed for ([117.3.140.34]) [117.3.140.34]:40010: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
description:
2025-01-29 15:51:33 dovecot_plain authenticator failed for ([220.180.107.193]) [220.180.107.193]:44954: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
description:
Jan 29 15:51:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.89.47
description:
[2025-01-29 15:51:12 +0100] info [webmaild] 45.186.89.47 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-01-29 15:51:21 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:49322: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-29 15:51:24 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (hortne) [91.56.31.167]:60300: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 29 15:51:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.50.161.83
description:
[2025-01-29 15:51:10 +0100] info [webmaild] 201.50.161.83 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
description:
2025-01-29 15:51:13 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:43602: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Jan 29 15:51:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-01-29 15:51:46 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:36174: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.212.42.188
description:
[2025-01-29 15:52:21 +0100] info [webmaild] 41.212.42.188 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 15:51:37 ait sshd[251555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 15:51:37 ait sshd[251555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 15:52:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Jan 29 15:52:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-01-29 15:52:40 dovecot_plain authenticator failed for (hells) [65.20.155.91]:43423: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.200
description:
[2025-01-29 15:53:55 +0100] info [cpaneld] 156.228.90.200 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.162
description:
[2025-01-29 15:53:58 +0100] info [cpaneld] 104.207.45.162 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.54.237.35
description:
[2025-01-29 15:54:07 +0100] info [webmaild] 185.54.237.35 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.222
description:
[2025-01-29 15:54:03 +0100] info [whostmgrd] 156.228.101.222 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.16
description:
[2025-01-29 15:54:05 +0100] info [whostmgrd] 104.207.41.16 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.89
description:
[2025-01-29 15:54:05 +0100] info [whostmgrd] 156.228.95.89 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.49
description:
[2025-01-29 15:54:07 +0100] info [whostmgrd] 156.228.125.49 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.81
description:
[2025-01-29 15:54:01 +0100] info [cpaneld] 156.228.112.81 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.167
description:
[2025-01-29 15:54:01 +0100] info [cpaneld] 156.228.111.167 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.114
description:
[2025-01-29 15:54:04 +0100] info [whostmgrd] 156.228.80.114 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.19
description:
[2025-01-29 15:54:06 +0100] info [whostmgrd] 156.228.124.19 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.72
description:
[2025-01-29 15:53:56 +0100] info [cpaneld] 156.228.125.72 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.249.61.172
description:
[2025-01-29 15:54:42 +0100] info [webmaild] 87.249.61.172 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.236.239.9
description:
[2025-01-29 15:55:03 +0100] info [webmaild] 176.236.239.9 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.198.34
description:
[2025-01-29 15:55:03 +0100] info [webmaild] 45.230.198.34 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.211
description:
[2025-01-29 15:55:47 +0100] info [cpaneld] 156.228.87.211 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.79.95
description:
[2025-01-29 15:55:51 +0100] info [whostmgrd] 156.228.79.95 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.149
description:
[2025-01-29 15:55:52 +0100] info [whostmgrd] 104.207.32.149 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.170
description:
[2025-01-29 15:55:53 +0100] info [whostmgrd] 104.207.50.170 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.207
description:
[2025-01-29 15:55:48 +0100] info [whostmgrd] 156.228.89.207 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-56.157.230.172.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.67
description:
[2025-01-29 15:55:46 +0100] info [cpaneld] 156.228.83.67 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 199.189.224.233
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-56.199.189.224.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.23.215.185
description:
[2025-01-29 15:56:14 +0100] info [webmaild] 31.23.215.185 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.113
description:
[2025-01-29 15:55:45 +0100] info [cpaneld] 104.207.55.113 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.73
description:
[2025-01-29 15:55:53 +0100] info [whostmgrd] 156.228.105.73 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.134
description:
[2025-01-29 15:55:47 +0100] info [cpaneld] 156.228.111.134 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.8
description:
[2025-01-29 15:55:50 +0100] info [whostmgrd] 156.228.105.8 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.168.36
description:
[2025-01-29 15:56:14 +0100] info [webmaild] 37.237.168.36 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.71
description:
[2025-01-29 15:55:44 +0100] info [cpaneld] 156.228.110.71 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.225.46
description:
Jan 29 15:57:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.225.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 129.45.40.49
description:
[2025-01-29 15:56:55 +0100] info [webmaild] 129.45.40.49 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.183.83
description:
[2025-01-29 15:56:58 +0100] info [webmaild] 138.118.183.83 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 29 15:57:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-57.104.209.253.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.225.46
description:
2025-01-29 15:57:30 dovecot_plain authenticator failed for ([58.58.225.46]) [58.58.225.46]:59063: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-29 15:57:19 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:52377: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.55.134
description:
[2025-01-29 15:57:43 +0100] info [webmaild] 177.8.55.134 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
description:
Jan 29 15:59:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 15:58:41 ait sshd[256509]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 15:58:56 ait sshd[256571]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 15:58:58 ait sshd[256547]: Invalid user responsivetemplates.nl 2001 from 111.231.56.128 port 60706


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.46.239
description:
Jan 29 15:59:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.46.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 15:58:56 ait sshd[256571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 15:59:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
description:
2025-01-29 15:59:25 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:53832: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.113.49.111
description:
[2025-01-29 15:59:33 +0100] info [webmaild] 189.113.49.111 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 15:58:41 ait sshd[256509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 15:58:58 ait sshd[256547]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 15:58:58 ait sshd[256547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.46.239
description:
2025-01-29 15:59:09 dovecot_plain authenticator failed for (abts-north-static-239.46.176.122.airtelbroadband.in) [122.176.46.239]:58241: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.17.123
description:
47.128.17.123 - - [29/Jan/2025:15:59:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18925908 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C61&filter_course-language=198%2C118%2C95%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.210.210.41
description:
[2025-01-29 16:00:20 +0100] info [webmaild] 178.210.210.41 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-01-29 16:01:04 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:46926: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 29 16:01:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.136.107.78
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-00.45.136.107.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-29 16:01:16 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:12959: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 29 16:02:10 ait sshd[258965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.35.211
description:
Jan 29 16:02:23 ait sshd[259123]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.35.211
description:
Jan 29 16:02:23 ait sshd[259123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.35.211


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 16:01:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.36.248.143
description:
[2025-01-29 16:02:06 +0100] info [webmaild] 39.36.248.143 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 29 16:02:10 ait sshd[258965]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.17.56.210
description:
[2025-01-29 16:03:45 +0100] info [webmaild] 191.17.56.210 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.35.237
description:
[2025-01-29 16:03:57 +0100] info [webmaild] 45.70.35.237 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 16:04:12 ait sshd[260375]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 16:04:12 ait sshd[260375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.68.183
description:
[2025-01-29 16:04:35 +0100] info [webmaild] 189.37.68.183 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
description:
Jan 29 16:05:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
description:
2025-01-29 16:05:22 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:40826: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 29 16:05:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-29 16:05:39 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:7890: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.164
description:
[2025-01-29 16:06:29 +0100] info [cpaneld] 104.207.48.164 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.221
description:
[2025-01-29 16:06:27 +0100] info [cpaneld] 104.207.53.221 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.183
description:
[2025-01-29 16:06:32 +0100] info [whostmgrd] 156.228.102.183 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.190.3
description:
[2025-01-29 16:06:04 +0100] info [webmaild] 177.105.190.3 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.170
description:
[2025-01-29 16:06:29 +0100] info [cpaneld] 156.228.117.170 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.142
description:
[2025-01-29 16:06:30 +0100] info [whostmgrd] 156.228.95.142 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.235
description:
[2025-01-29 16:06:31 +0100] info [whostmgrd] 156.228.96.235 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 29 16:05:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.42
description:
[2025-01-29 16:06:27 +0100] info [cpaneld] 156.228.90.42 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.52
description:
[2025-01-29 16:06:30 +0100] info [whostmgrd] 156.228.118.52 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.11
description:
[2025-01-29 16:06:31 +0100] info [whostmgrd] 104.207.35.11 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.254
description:
[2025-01-29 16:06:32 +0100] info [whostmgrd] 156.228.83.254 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.204
description:
[2025-01-29 16:06:26 +0100] info [cpaneld] 156.228.87.204 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.71.251.4
description:
[2025-01-29 16:07:25 +0100] info [webmaild] 188.71.251.4 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.201.219.10
description:
[2025-01-29 16:07:29 +0100] info [webmaild] 88.201.219.10 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.230.41.251
description:
[2025-01-29 16:06:38 +0100] info [webmaild] 88.230.41.251 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 29 16:08:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-29 16:08:04 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:36809: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Jan 29 16:07:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-01-29 16:07:54 dovecot_login authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:35736: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 16:08:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.85.155.101
description:
[2025-01-29 16:08:47 +0100] info [webmaild] 181.85.155.101 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.169
description:
[2025-01-29 16:08:38 +0100] info [cpaneld] 104.207.38.169 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.124
description:
[2025-01-29 16:08:38 +0100] info [cpaneld] 156.228.89.124 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.207
description:
[2025-01-29 16:08:42 +0100] info [cpaneld] 156.228.110.207 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.14
description:
[2025-01-29 16:08:43 +0100] info [whostmgrd] 156.228.99.14 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.213.179.3
description:
[2025-01-29 16:08:43 +0100] info [webmaild] 81.213.179.3 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.166
description:
[2025-01-29 16:08:46 +0100] info [whostmgrd] 104.207.47.166 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.211
description:
[2025-01-29 16:08:47 +0100] info [whostmgrd] 154.214.1.211 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.63.20.123
description:
[2025-01-29 16:09:10 +0100] info [webmaild] 177.63.20.123 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.103.190.206
description:
[2025-01-29 16:09:27 +0100] info [webmaild] 190.103.190.206 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.248
description:
[2025-01-29 16:08:45 +0100] info [whostmgrd] 104.207.49.248 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.15
description:
[2025-01-29 16:08:42 +0100] info [cpaneld] 156.228.119.15 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.171
description:
[2025-01-29 16:08:44 +0100] info [whostmgrd] 156.228.117.171 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.119
description:
[2025-01-29 16:08:45 +0100] info [whostmgrd] 156.228.112.119 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.107.176
description:
[2025-01-29 16:08:39 +0100] info [cpaneld] 156.228.107.176 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.211.228
description:
2025-01-29 16:10:17 dovecot_plain authenticator failed for ([112.164.211.228]) [112.164.211.228]:51016: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.168.243
description:
2025-01-29 16:10:31 dovecot_plain authenticator failed for ([120.236.168.243]) [120.236.168.243]:48682: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-29 16:10:26 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:12960: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.168.243
description:
Jan 29 16:10:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.168.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.150.115
description:
Jan 29 16:10:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.150.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.36.222.103
description:
[2025-01-29 16:09:45 +0100] info [webmaild] 189.36.222.103 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.211.228
description:
Jan 29 16:10:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.211.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 29 16:10:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.233.123.32
description:
[2025-01-29 16:11:31 +0100] info [webmaild] 193.233.123.32 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
description:
2025-01-29 16:10:37 dovecot_plain authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:51603: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.55.151
description:
47.128.55.151 - - [29/Jan/2025:16:11:07 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25947758 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/10/?filtering=1&level=intermediate%2Cbeginner&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.55.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.53.96
description:
[2025-01-29 16:11:29 +0100] info [webmaild] 191.242.53.96 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-12.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 16:13:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.99
description:
47.128.52.99 - - [29/Jan/2025:16:13:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16365274 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=120%2C198%2C99" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.99


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.27.25
description:
[2025-01-29 16:14:14 +0100] info [webmaild] 160.238.27.25 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 29 16:13:50 ait sshd[266131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 159.223.206.253
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-14.159.223.206.253||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 16:15:49 ait sshd[267518]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 16:15:49 ait sshd[267518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 16:16:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 29 16:16:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.165
description:
47.128.62.165 - - [29/Jan/2025:16:16:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20327442 HTTP/2.0" 302 0 worldwide-university.com "https://worldwide-university.com/cgi-sys/suspendedpage.cgi?__im-DyhGbcnb=602694163829596053&order_by=newest" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.165


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.211.124
description:
[2025-01-29 16:16:17 +0100] info [webmaild] 45.177.211.124 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-29 16:16:34 dovecot_plain authenticator failed for (coninomers) [62.231.31.86]:54843: 535 Incorrect authentication data (set_id=info@aitedu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.158
description:
Jan 29 16:16:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-01-29 16:16:53 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:45529: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.158
description:
2025-01-29 16:16:44 dovecot_plain authenticator failed for ([217.22.37.158]) [217.22.37.158]:54837: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 29 16:17:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.110
description:
[2025-01-29 16:17:14 +0100] info [webmaild] 213.230.86.110 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.19.9.140
description:
[2025-01-29 16:17:08 +0100] info [webmaild] 179.19.9.140 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.74.220
description:
[2025-01-29 16:16:39 +0100] info [webmaild] 179.60.74.220 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Jan 29 16:16:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.62.71.244
description:
[2025-01-29 16:17:25 +0100] info [webmaild] 92.62.71.244 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.89.134
description:
2025-01-29 16:18:21 dovecot_plain authenticator failed for ([112.28.89.134]) [112.28.89.134]:59809: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Jan 29 16:18:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-01-29 16:18:08 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:58121: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 16:18:59 ait sshd[269444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 16:18:59 ait sshd[269444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.194.119
description:
[2025-01-29 16:19:31 +0100] info [webmaild] 181.78.194.119 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 16:20:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Jan 29 16:19:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.104.172
description:
2025-01-29 16:19:53 dovecot_login authenticator failed for ([65.76.104.172]) [65.76.104.172]:43298: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.204.209.131
description:
[2025-01-29 16:20:01 +0100] info [webmaild] 103.204.209.131 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.104.91
description:
[2025-01-29 16:20:13 +0100] info [webmaild] 169.224.104.91 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 16:20:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-01-29 16:19:43 dovecot_login authenticator failed for ([220.185.225.50]) [220.185.225.50]:36300: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.104.172
description:
Jan 29 16:19:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.104.172 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.128.165.171
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-20.118.128.165.171


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.19.132
description:
[2025-01-29 16:21:19 +0100] info [webmaild] 45.180.19.132 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.250.34.159
description:
[2025-01-29 16:22:01 +0100] info [webmaild] 186.250.34.159 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.140.30.142
description:
[2025-01-29 16:21:39 +0100] info [webmaild] 91.140.30.142 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.36.246
description:
[2025-01-29 16:21:58 +0100] info [webmaild] 45.6.36.246 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.251.45.210
description:
[2025-01-29 16:21:39 +0100] info [webmaild] 154.251.45.210 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.114.196
description:
Jan 29 16:22:41 ait sshd[272121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.136.114.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.195.91.241
description:
Jan 29 16:22:50 ait sshd[272187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.91.241


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.136.114.196
description:
Jan 29 16:22:41 ait sshd[272121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.136.114.196


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.224.169
description:
[2025-01-29 16:22:49 +0100] info [webmaild] 45.71.224.169 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.195.91.241
description:
Jan 29 16:22:50 ait sshd[272187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.195.91.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 29 16:23:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.99
description:
Jan 29 16:24:27 ait sshd[273163]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.99
description:
Jan 29 16:24:27 ait sshd[273163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.99


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.172.76
description:
[2025-01-29 16:23:43 +0100] info [webmaild] 191.243.172.76 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 16:24:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 16:24:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.185.83.37
description:
Jan 29 16:25:17 ait sshd[273955]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.185.83.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.185.83.37
description:
Jan 29 16:25:17 ait sshd[273955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.185.83.37


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.54.170.178
description:
Jan 29 16:26:36 ait sshd[274787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.170.178


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 16:26:48 ait sshd[275098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.99
description:
Jan 29 16:27:01 ait sshd[275215]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 16:26:48 ait sshd[275098]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.99
description:
Jan 29 16:27:01 ait sshd[275215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.99


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.114.196
description:
Jan 29 16:26:53 ait sshd[275106]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.136.114.196 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.136.114.196
description:
Jan 29 16:26:55 ait sshd[275106]: Failed password for invalid user admin from 2.136.114.196 port 40856 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.195.91.241
description:
Jan 29 16:26:55 ait sshd[275166]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.195.91.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.170.178
description:
Jan 29 16:26:36 ait sshd[274787]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.54.170.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.136.114.196
description:
Jan 29 16:26:53 ait sshd[275106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.136.114.196


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.195.91.241
description:
Jan 29 16:26:55 ait sshd[275166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.91.241


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.112.239.129
description:
[2025-01-29 16:28:11 +0100] info [webmaild] 196.112.239.129 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.99
description:
Jan 29 16:28:22 ait sshd[276237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.62.94
description:
Jan 29 16:27:57 ait sshd[275912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.62.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 16:28:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.170.178
description:
Jan 29 16:28:16 ait sshd[276176]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.54.170.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 16:28:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.199.233.229
description:
[2025-01-29 16:28:36 +0100] info [webmaild] 217.199.233.229 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.54.170.178
description:
Jan 29 16:28:16 ait sshd[276176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.170.178


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.99
description:
Jan 29 16:28:22 ait sshd[276237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.99


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.149.14
description:
Jan 29 16:29:20 ait sshd[276771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.149.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.199.129
description:
Jan 29 16:29:06 ait sshd[276649]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.142.199.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.142.199.129
description:
Jan 29 16:29:06 ait sshd[276649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.142.199.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.22.119.202
description:
[2025-01-29 16:29:13 +0100] info [webmaild] 187.22.119.202 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.235.237.169
description:
[2025-01-29 16:29:31 +0100] info [webmaild] 179.235.237.169 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.149.14
description:
Jan 29 16:29:20 ait sshd[276771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.149.14


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 16:29:48 ait sshd[277029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.170.178
description:
Jan 29 16:29:50 ait sshd[277041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.54.170.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.54.170.178
description:
Jan 29 16:29:50 ait sshd[277041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.170.178


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 16:29:48 ait sshd[277029]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.45.82.107
description:
[2025-01-29 16:31:32 +0100] info [webmaild] 212.45.82.107 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.185.83.37
description:
Jan 29 16:30:46 ait sshd[277874]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.185.83.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 16:30:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 16:31:06 ait sshd[278353]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 16:31:06 ait sshd[278353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 16:30:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.185.83.37
description:
Jan 29 16:30:46 ait sshd[277874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.185.83.37


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.142.199.129
description:
Jan 29 16:31:51 ait sshd[278861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.142.199.129


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.62.94
description:
Jan 29 16:32:18 ait sshd[279366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.62.94


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.185.83.37
description:
Jan 29 16:32:22 ait sshd[279422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.185.83.37


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.199.129
description:
Jan 29 16:31:51 ait sshd[278861]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.142.199.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.185.83.37
description:
Jan 29 16:32:22 ait sshd[279422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.185.83.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.161.62
description:
[2025-01-29 16:32:27 +0100] info [webmaild] 90.156.161.62 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.164
description:
[2025-01-29 16:32:34 +0100] info [webmaild] 84.54.70.164 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.199.129
description:
Jan 29 16:33:25 ait sshd[280185]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.142.199.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 16:32:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.142.199.129
description:
Jan 29 16:33:25 ait sshd[280185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.142.199.129


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.142.199.129
description:
Jan 29 16:33:27 ait sshd[280185]: Failed password for invalid user nmr from 103.142.199.129 port 53206 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.6.93.197
description:
[2025-01-29 16:34:01 +0100] info [webmaild] 213.6.93.197 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.7.21.161
description:
[2025-01-29 16:34:29 +0100] info [webmaild] 45.7.21.161 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.144.79.184
description:
[2025-01-29 16:33:45 +0100] info [webmaild] 197.144.79.184 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.33.139
description:
[2025-01-29 16:33:51 +0100] info [webmaild] 190.114.33.139 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.62.94
description:
Jan 29 16:34:23 ait sshd[280814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.62.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.101.87.61
description:
[2025-01-29 16:33:38 +0100] info [webmaild] 78.101.87.61 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 163.47.148.242
description:
[2025-01-29 16:33:51 +0100] info [webmaild] 163.47.148.242 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 16:34:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.39.214
description:
47.128.39.214 - - [29/Jan/2025:16:34:27 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11484605 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C125%2C61&filter_course-language=121%2C120%2C198%2C95%2C118" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.39.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 16:35:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.39.85.2
description:
[2025-01-29 16:35:50 +0100] info [webmaild] 186.39.85.2 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.108.17.122
description:
Jan 29 16:36:10 ait sshd[282402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.108.17.122 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 188.245.228.175
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-36.188.245.228.175


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.159.153.119
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-36.185.159.153.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 16:35:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.230.127.224
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-36.213.230.127.224


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 109.202.99.46
domain: ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/_vti_pvt/administrators.pwd||User:aitext01||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 16:35:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.108.17.122
description:
Jan 29 16:36:10 ait sshd[282402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.108.17.122


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 16:37:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-01-29 16:39:33 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:27874: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.211.94
description:
[2025-01-29 16:38:44 +0100] info [webmaild] 45.165.211.94 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.206.220.140
description:
[2025-01-29 16:39:10 +0100] info [webmaild] 186.206.220.140 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.214.168.101
description:
Jan 29 16:39:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.214.168.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.214.168.101
description:
2025-01-29 16:39:21 dovecot_plain authenticator failed for d-24-214-168-101.oh.cpe.breezeline.net [24.214.168.101]:34369: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Jan 29 16:39:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.49.225.218
description:
Jan 29 16:39:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.49.225.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Jan 29 16:39:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 16:40:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 16:40:25 ait sshd[285582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.149.14
description:
Jan 29 16:40:08 ait sshd[285284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.149.14


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.218.125.245
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-40.185.218.125.245


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 29 16:39:45 ait sshd[284874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-01-29 16:39:58 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:48526: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.149.14
description:
Jan 29 16:40:08 ait sshd[285284]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.149.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 29 16:39:45 ait sshd[284874]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.49.225.218
description:
2025-01-29 16:39:47 dovecot_plain authenticator failed for (161.49.225.218.convergeict.com) [161.49.225.218]:39765: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 16:40:25 ait sshd[285582]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.252.18.246
description:
Jan 29 16:41:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.252.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.252.18.246
description:
2025-01-29 16:41:34 dovecot_login authenticator failed for ([162.252.18.246]) [162.252.18.246]:42860: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Jan 29 16:40:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.107.202.202
description:
[2025-01-29 16:41:04 +0100] info [webmaild] 190.107.202.202 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.108.17.122
description:
Jan 29 16:41:16 ait sshd[286253]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.108.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
description:
2025-01-29 16:41:24 dovecot_login authenticator failed for ([197.136.236.1]) [197.136.172.98]:43310: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.108.17.122
description:
Jan 29 16:41:16 ait sshd[286253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.108.17.122


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
description:
Jan 29 16:41:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.255.208.23
description:
[2025-01-29 16:41:50 +0100] info [webmaild] 38.255.208.23 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.31.166.91
description:
[2025-01-29 16:41:57 +0100] info [webmaild] 189.31.166.91 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.111.57
description:
47.128.111.57 - - [29/Jan/2025:16:43:01 +0100] "GET /wp-content/plugins/formidable/css/formidableforms.css?ver=5171112 HTTP/2.0" 200 1530 ait.edu.gh "https://ait.edu.gh/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=30053931" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.111.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 16:43:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
description:
Jan 29 16:43:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.108.17.122
description:
Jan 29 16:42:40 ait sshd[287093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.108.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.108.17.122
description:
Jan 29 16:42:40 ait sshd[287093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.108.17.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.108.17.122
description:
Jan 29 16:42:42 ait sshd[287093]: Failed password for invalid user user1 from 124.108.17.122 port 46772 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.169.0.232
description:
[2025-01-29 16:44:08 +0100] info [webmaild] 152.169.0.232 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.223.173.155
description:
Jan 29 16:43:52 ait sshd[287679]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.223.173.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.223.173.155
description:
Jan 29 16:43:52 ait sshd[287679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.223.173.155


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 29 16:44:38 ait sshd[288193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.221.20.98
description:
[2025-01-29 16:44:43 +0100] info [webmaild] 83.221.20.98 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.202.205
description:
[2025-01-29 16:44:51 +0100] info [webmaild] 45.231.202.205 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 29 16:45:25 ait sshd[288910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 29 16:44:38 ait sshd[288193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.208.182.39
description:
[2025-01-29 16:45:03 +0100] info [webmaild] 181.208.182.39 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 16:45:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 29 16:45:25 ait sshd[288910]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-29 16:46:12 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-179.static.tpgi.com.au) [110.175.220.250]:42179: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.113.188.38
description:
[2025-01-29 16:46:14 +0100] info [webmaild] 189.113.188.38 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.127.4.65
description:
[2025-01-29 16:46:21 +0100] info [webmaild] 103.127.4.65 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.235
description:
Jan 29 16:45:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.235
description:
2025-01-29 16:45:54 dovecot_plain authenticator failed for 110-25-105-235.adsl.fetnet.net [110.25.105.235]:48388: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 29 16:46:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 148.222.203.176
description:
[2025-01-29 16:46:12 +0100] info [webmaild] 148.222.203.176 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.20.243.124
description:
[2025-01-29 16:46:12 +0100] info [webmaild] 103.20.243.124 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 16:46:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.74.114
description:
[2025-01-29 16:47:03 +0100] info [webmaild] 170.150.74.114 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 16:47:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-01-29 16:48:27 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:40602: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.149.14
description:
Jan 29 16:47:38 ait sshd[290404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.149.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.94.118.150
description:
[2025-01-29 16:47:57 +0100] info [webmaild] 45.94.118.150 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
description:
Jan 29 16:48:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Jan 29 16:48:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
description:
2025-01-29 16:48:28 dovecot_plain authenticator failed for ([210.84.5.183]) [210.84.5.183]:41822: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.149.14
description:
Jan 29 16:47:38 ait sshd[290404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.149.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.75.172.163
description:
2025-01-29 16:48:40 dovecot_plain authenticator failed for ([220.75.172.163]) [220.75.172.163]:45972: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
description:
2025-01-29 16:48:39 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:41975: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-49.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.86.7.65
description:
Jan 29 16:48:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.86.7.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.75.172.163
description:
Jan 29 16:48:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.75.172.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.168
description:
2025-01-29 16:50:08 dovecot_plain authenticator failed for ([61.80.161.168]) [61.80.161.168]:41351: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.254.153
description:
[2025-01-29 16:50:10 +0100] info [webmaild] 138.185.254.153 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.128.108
description:
Jan 29 16:50:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.128.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 16:49:52 ait sshd[291598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 16:49:52 ait sshd[291598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.161.168
description:
Jan 29 16:50:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.161.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.128.108
description:
2025-01-29 16:50:21 dovecot_plain authenticator failed for ([39.129.128.108]) [39.129.128.108]:38800: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-01-29 16:51:10 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:45209: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.95.18
description:
Jan 29 16:51:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.95.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
description:
2025-01-29 16:51:02 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:40972: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 16:50:46 ait sshd[292601]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.242.102.131
domain: scholarship.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-51.195.242.102.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.123.3
description:
[2025-01-29 16:51:24 +0100] info [webmaild] 170.233.123.3 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
description:
Jan 29 16:51:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 16:50:46 ait sshd[292601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.177.55
description:
2025-01-29 16:52:15 dovecot_plain authenticator failed for ([209.141.177.55]) [209.141.177.55]:51951: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.58.190
description:
Jan 29 16:52:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.58.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.58.190
description:
2025-01-29 16:52:33 dovecot_plain authenticator failed for p165190-obmd01.tokyo.ocn.ne.jp [153.141.58.190]:48372: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.141.177.55
description:
Jan 29 16:52:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.141.177.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Jan 29 16:53:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 16:52:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 29 16:53:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-29 16:53:09 dovecot_plain authenticator failed for (189-57-233-32.customer.tdatabrasil.net.br) [186.238.43.146]:35677: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.96.60.254
description:
[2025-01-29 16:53:29 +0100] info [webmaild] 83.96.60.254 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-01-29 16:53:38 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:20644: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 16:53:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 16:53:42 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:33634: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.35.54.73
description:
Jan 29 16:53:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.35.54.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.20.47.218
description:
[2025-01-29 16:54:11 +0100] info [webmaild] 187.20.47.218 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.78.204
description:
[2025-01-29 16:54:37 +0100] info [webmaild] 84.54.78.204 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
description:
Jan 29 16:56:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-29 16:56:35 dovecot_plain authenticator failed for (phiters) [207.188.157.230]:19682: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
description:
Jan 29 16:56:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-29 16:56:13 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:53892: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 29 16:56:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
description:
2025-01-29 16:56:10 dovecot_plain authenticator failed for ([83.237.42.54]) [83.237.42.54]:48074: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 29 16:56:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 29 16:56:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.21.242.163
description:
[2025-01-29 16:56:16 +0100] info [webmaild] 46.21.242.163 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-29 16:56:28 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:45686: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-01-29 16:56:28 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:40426: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.126.51.40
description:
[2025-01-29 16:55:48 +0100] info [webmaild] 187.126.51.40 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.94.150.1
description:
[2025-01-29 16:57:25 +0100] info [webmaild] 187.94.150.1 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.208.238.194
description:
[2025-01-29 16:57:33 +0100] info [webmaild] 186.208.238.194 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Jan 29 16:57:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 210.211.61.143
description:
[2025-01-29 16:58:21 +0100] info [webmaild] 210.211.61.143 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.195.163
description:
[2025-01-29 16:58:21 +0100] info [webmaild] 177.137.195.163 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
description:
2025-01-29 16:58:09 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:50550: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.40.138
description:
Jan 29 16:58:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.40.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-01-29 16:57:52 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:36022: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.162.66
description:
[2025-01-29 16:58:34 +0100] info [webmaild] 45.187.162.66 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.46
description:
[2025-01-29 16:59:01 +0100] info [webmaild] 213.230.87.46 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 16:58:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.143
description:
47.128.98.143 - - [29/Jan/2025:17:00:13 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13717572 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?filter_course-language=79&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
description:
2025-01-29 17:00:34 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:56534: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.194.178
description:
[2025-01-29 16:59:44 +0100] info [webmaild] 128.201.194.178 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.206.125.48
description:
[2025-01-29 17:00:20 +0100] info [webmaild] 197.206.125.48 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.160.128.46
description:
Jan 29 17:00:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.160.128.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.162.4.215
description:
[2025-01-29 17:01:30 +0100] info [webmaild] 177.162.4.215 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
description:
Jan 29 17:00:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-01-29 17:00:41 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:35282: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-01-29 17:04:03 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:53248: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.92.33.198
description:
2025-01-29 17:04:12 dovecot_plain authenticator failed for syn-070-092-033-198.biz.spectrum.com [70.92.33.198]:47439: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.18.252.107
description:
Jan 29 17:04:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.18.252.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.18.252.107
description:
2025-01-29 17:04:31 dovecot_plain authenticator failed for ([14.18.252.107]) [14.18.252.107]:6749: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.247.37.8
description:
[2025-01-29 17:03:59 +0100] info [webmaild] 170.247.37.8 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Jan 29 17:04:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.92.33.198
description:
Jan 29 17:04:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.92.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.206
description:
2025-01-29 17:04:53 dovecot_plain authenticator failed for ([27.45.233.206]) [27.45.233.206]:47361: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-01-29 17:04:41 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:34055: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-05.157.230.172.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
description:
Jan 29 17:04:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
description:
2025-01-29 17:04:55 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:37356: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.206
description:
Jan 29 17:04:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
description:
Jan 29 17:04:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.158.172.18
description:
[2025-01-29 17:06:09 +0100] info [webmaild] 102.158.172.18 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.232
description:
Jan 29 17:06:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.79.24.23
description:
Jan 29 17:06:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.79.24.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.146
description:
[2025-01-29 17:06:33 +0100] info [whostmgrd] 156.228.94.146 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.122
description:
[2025-01-29 17:06:28 +0100] info [cpaneld] 156.228.81.122 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.103.152
description:
[2025-01-29 17:06:31 +0100] info [cpaneld] 156.228.103.152 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.67
description:
[2025-01-29 17:06:34 +0100] info [whostmgrd] 156.228.117.67 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.79.24.23
description:
2025-01-29 17:06:07 dovecot_plain authenticator failed for host-79-79-24-23.static.as13285.net [79.79.24.23]:55586: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.146
description:
[2025-01-29 17:06:36 +0100] info [whostmgrd] 156.228.119.146 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.32
description:
[2025-01-29 17:06:35 +0100] info [whostmgrd] 104.207.41.32 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 17:06:22 ait sshd[303056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.108.101
description:
[2025-01-29 17:06:27 +0100] info [cpaneld] 156.228.108.101 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.241
description:
[2025-01-29 17:06:28 +0100] info [cpaneld] 104.207.54.241 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.33.101
description:
[2025-01-29 17:06:34 +0100] info [whostmgrd] 104.207.33.101 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.127.51.114
description:
[2025-01-29 17:06:34 +0100] info [webmaild] 45.127.51.114 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.133
description:
[2025-01-29 17:06:35 +0100] info [whostmgrd] 104.207.35.133 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.232
description:
2025-01-29 17:06:21 dovecot_plain authenticator failed for (abts-ap-dynamic-232.205.169.122.airtelbroadband.in) [122.169.205.232]:43962: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 17:06:22 ait sshd[303056]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.125
description:
[2025-01-29 17:06:31 +0100] info [cpaneld] 156.228.111.125 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 29 17:07:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.159.5
description:
[2025-01-29 17:06:58 +0100] info [webmaild] 177.12.159.5 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-29 17:07:04 dovecot_plain authenticator failed for ([222.186.68.153]) [222.186.68.153]:41356: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Jan 29 17:06:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-01-29 17:06:40 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:45696: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.177.89.201
description:
[2025-01-29 17:07:33 +0100] info [webmaild] 201.177.89.201 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.221
description:
[2025-01-29 17:08:07 +0100] info [cpaneld] 104.207.61.221 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.247
description:
[2025-01-29 17:08:08 +0100] info [cpaneld] 156.228.116.247 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.189
description:
[2025-01-29 17:08:09 +0100] info [cpaneld] 104.207.36.189 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.19
description:
[2025-01-29 17:08:10 +0100] info [cpaneld] 156.228.125.19 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.178
description:
[2025-01-29 17:08:11 +0100] info [cpaneld] 156.228.89.178 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.218
description:
[2025-01-29 17:08:12 +0100] info [cpaneld] 156.228.93.218 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.100.17
description:
[2025-01-29 17:08:14 +0100] info [whostmgrd] 156.228.100.17 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 29 17:07:52 ait sshd[304187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.188
description:
[2025-01-29 17:08:13 +0100] info [whostmgrd] 156.228.112.188 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.180.3.11
description:
[2025-01-29 17:08:35 +0100] info [webmaild] 78.180.3.11 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.72
description:
[2025-01-29 17:08:07 +0100] info [cpaneld] 156.228.118.72 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.173
description:
[2025-01-29 17:08:08 +0100] info [cpaneld] 156.228.125.173 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.97.228
description:
[2025-01-29 17:08:10 +0100] info [cpaneld] 156.228.97.228 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.77
description:
[2025-01-29 17:08:12 +0100] info [whostmgrd] 104.207.41.77 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.34.87
description:
[2025-01-29 17:08:13 +0100] info [whostmgrd] 104.207.34.87 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.57
description:
[2025-01-29 17:08:12 +0100] info [whostmgrd] 156.228.114.57 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.98
description:
[2025-01-29 17:08:13 +0100] info [whostmgrd] 156.228.111.98 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.146
description:
[2025-01-29 17:08:15 +0100] info [whostmgrd] 156.228.125.146 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.238
description:
[2025-01-29 17:08:20 +0100] info [whostmgrd] 104.207.40.238 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.62.124
description:
[2025-01-29 17:08:12 +0100] info [cpaneld] 104.207.62.124 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.84
description:
[2025-01-29 17:08:11 +0100] info [whostmgrd] 156.228.90.84 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.108.54
description:
[2025-01-29 17:08:13 +0100] info [whostmgrd] 156.228.108.54 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.145
description:
[2025-01-29 17:08:21 +0100] info [whostmgrd] 104.207.44.145 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 29 17:07:52 ait sshd[304187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.246
description:
[2025-01-29 17:08:19 +0100] info [whostmgrd] 154.214.1.246 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-29 17:09:04 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:47181: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Jan 29 17:09:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-01-29 17:09:16 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:52337: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 29 17:09:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 17:10:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 29 17:10:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-29 17:10:18 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:53538: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.98.139
description:
Jan 29 17:10:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.98.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.98.33.132
description:
[2025-01-29 17:10:02 +0100] info [webmaild] 86.98.33.132 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.24.53.132
description:
[2025-01-29 17:10:24 +0100] info [webmaild] 95.24.53.132 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.98.139
description:
2025-01-29 17:10:29 dovecot_plain authenticator failed for (abts-mum-static-139.98.170.122.airtelbroadband.in) [122.170.98.139]:57971: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.55.146.15
description:
[2025-01-29 17:10:39 +0100] info [cpaneld] 103.55.146.15 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.92.139.40
description:
[2025-01-29 17:10:40 +0100] info [webmaild] 185.92.139.40 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.72.148
description:
[2025-01-29 17:11:00 +0100] info [webmaild] 179.189.72.148 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.9.14.172
description:
[2025-01-29 17:10:51 +0100] info [webmaild] 194.9.14.172 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.193.61
description:
[2025-01-29 17:11:23 +0100] info [webmaild] 45.183.193.61 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.77.60
description:
[2025-01-29 17:12:31 +0100] info [webmaild] 131.196.77.60 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.244.75
description:
[2025-01-29 17:12:07 +0100] info [webmaild] 187.19.244.75 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.150.36
description:
[2025-01-29 17:12:23 +0100] info [webmaild] 138.122.150.36 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.51.244
description:
47.128.51.244 - - [29/Jan/2025:17:11:38 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19671206 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C205&filter_course-language=95%2C121%2C120%2C99&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.51.244


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 29 17:12:51 ait sshd[307261]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 29 17:12:51 ait sshd[307261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.235.121
description:
Jan 29 17:14:07 ait sshd[307884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.235.121


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.165.191.26
description:
Jan 29 17:14:31 ait dovecot[4150387]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.165.191.26, lip=136.243.145.84, TLS, session=<PDLFmtosiMm5pb8a>


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.239.136
description:
Jan 29 17:14:16 ait sshd[307935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.239.136


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.203.233
description:
Jan 29 17:15:18 ait sshd[308857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.203.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.133.104
description:
Jan 29 17:15:30 ait sshd[308945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.133.104


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.203.233
description:
Jan 29 17:15:18 ait sshd[308857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.203.233


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.254.55.203
description:
Jan 29 17:14:57 ait sshd[308491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.254.55.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 17:15:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 29 17:15:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-29 17:15:54 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:33251: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-01-29 17:16:07 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:57444: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-01-29 17:16:11 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:60623: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
description:
2025-01-29 17:15:45 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:33486: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.157.246.26
description:
Jan 29 17:15:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.157.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.85.163
description:
2025-01-29 17:16:10 dovecot_plain authenticator failed for ([87.201.85.163]) [87.201.85.163]:44458: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 17:16:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.85.163
description:
Jan 29 17:16:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.201.85.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Jan 29 17:16:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.126
description:
Jan 29 17:15:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
description:
2025-01-29 17:15:51 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:51937: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Jan 29 17:16:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-01-29 17:16:04 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:51602: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Jan 29 17:16:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
description:
Jan 29 17:15:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.157.246.26
description:
2025-01-29 17:15:50 dovecot_plain authenticator failed for ([117.157.246.26]) [117.157.246.26]:43570: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.143.29.18
description:
[2025-01-29 17:16:28 +0100] info [webmaild] 45.143.29.18 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.203.233
description:
Jan 29 17:17:24 ait sshd[310557]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.203.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.179.30
description:
Jan 29 17:17:03 ait sshd[310413]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.179.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.179.30
description:
Jan 29 17:17:03 ait sshd[310413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.179.30


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.203.233
description:
Jan 29 17:17:24 ait sshd[310557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.203.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 17:16:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.235.121
description:
Jan 29 17:17:18 ait sshd[310524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.235.121  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.179.30
description:
Jan 29 17:18:35 ait sshd[311449]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.179.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.179.30
description:
Jan 29 17:18:35 ait sshd[311449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.179.30


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.125.198
description:
47.128.125.198 - - [29/Jan/2025:17:17:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17532837 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?filter_course-category=61&filter_course-language=183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.125.198


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.133.104
description:
Jan 29 17:18:23 ait sshd[311223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.133.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.33.74
description:
[2025-01-29 17:17:56 +0100] info [webmaild] 177.137.33.74 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.254.55.203
description:
Jan 29 17:18:13 ait sshd[311125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.254.55.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.63.4.149
description:
[2025-01-29 17:18:39 +0100] info [webmaild] 197.63.4.149 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Jan 29 17:19:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.203.233
description:
Jan 29 17:18:51 ait sshd[311526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.203.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
description:
Jan 29 17:19:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.179.30
description:
Jan 29 17:18:37 ait sshd[311449]: Failed password for invalid user ftpuser from 162.241.179.30 port 42080 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 17:18:38 ait sshd[311457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 17:18:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.233
description:
Jan 29 17:18:53 ait sshd[311526]: Failed password for invalid user nx from 152.32.203.233 port 34098 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
description:
2025-01-29 17:19:24 dovecot_plain authenticator failed for ([49.207.177.75]) [49.207.177.75]:38620: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-01-29 17:19:36 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:52641: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 17:18:38 ait sshd[311457]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.203.233
description:
Jan 29 17:18:51 ait sshd[311526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.203.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 17:18:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.150.35.24
description:
[2025-01-29 17:19:03 +0100] info [webmaild] 41.150.35.24 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.207.138.172
description:
[2025-01-29 17:20:03 +0100] info [webmaild] 186.207.138.172 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.235.121
description:
Jan 29 17:20:07 ait sshd[312490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.235.121


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.179.30
description:
Jan 29 17:19:49 ait sshd[312147]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.179.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.179.30
description:
Jan 29 17:19:49 ait sshd[312147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.179.30


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.133.104
description:
Jan 29 17:19:41 ait sshd[312026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.133.104  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 17:19:43 ait sshd[312046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 17:19:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.239.136
description:
Jan 29 17:19:48 ait sshd[312028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.239.136


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 17:19:43 ait sshd[312046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.254.55.203
description:
Jan 29 17:19:47 ait sshd[312056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.254.55.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Jan 29 17:21:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
description:
2025-01-29 17:21:25 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:32860: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-29 17:21:01 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:60606: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 17:21:30 ait sshd[313697]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 17:21:30 ait sshd[313697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-01-29 17:21:10 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:2059: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Jan 29 17:21:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-29 17:21:14 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:50422: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
description:
Jan 29 17:21:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.239.136
description:
Jan 29 17:21:28 ait sshd[313628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.239.136


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.233.120.122
description:
[2025-01-29 17:20:58 +0100] info [webmaild] 181.233.120.122 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 29 17:20:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.174.66.43
description:
[2025-01-29 17:22:32 +0100] info [webmaild] 85.174.66.43 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 17:21:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 17:21:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.216.198.219
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-23.195.216.198.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.119.161.151
description:
[2025-01-29 17:23:36 +0100] info [webmaild] 196.119.161.151 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.206.255.210
description:
[2025-01-29 17:23:04 +0100] info [webmaild] 186.206.255.210 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-23.171.244.129.243


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.222.86.108
description:
[2025-01-29 17:23:11 +0100] info [webmaild] 38.222.86.108 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.101.40.123
description:
[2025-01-29 17:22:41 +0100] info [webmaild] 187.101.40.123 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.220.52.99
description:
[2025-01-29 17:23:07 +0100] info [webmaild] 179.220.52.99 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.126.46.7
description:
[2025-01-29 17:23:59 +0100] info [webmaild] 187.126.46.7 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-29 17:24:16 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:52292: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-01-29 17:24:20 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:56746: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Jan 29 17:24:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 29 17:24:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
description:
Jan 29 17:24:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-01-29 17:24:07 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:60669: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Jan 29 17:24:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 29 17:24:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 17:25:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-29 17:24:38 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:9651: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.94.208
description:
[2025-01-29 17:24:50 +0100] info [webmaild] 84.54.94.208 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 29 17:25:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-29 17:25:32 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:43540: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.200.37.139
description:
[2025-01-29 17:24:40 +0100] info [webmaild] 185.200.37.139 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.97.90.143
description:
2025-01-29 17:27:06 dovecot_login authenticator failed for ([180.97.90.143]) [180.97.90.143]:52166: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
description:
Jan 29 17:27:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
description:
2025-01-29 17:27:14 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:35700: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 17:26:46 ait sshd[317140]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 17:26:46 ait sshd[317140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.97.90.143
description:
Jan 29 17:27:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.97.90.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-01-29 17:28:02 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:59681: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Jan 29 17:28:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Jan 29 17:28:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-01-29 17:28:13 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:12685: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.73.115.252
description:
[2025-01-29 17:29:11 +0100] info [webmaild] 119.73.115.252 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.114.130
description:
[2025-01-29 17:29:05 +0100] info [webmaild] 177.91.114.130 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-01-29 17:30:24 dovecot_login authenticator failed for ([181.233.93.3]) [181.233.93.66]:53355: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 29 17:30:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 17:30:18 ait sshd[319645]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 17:30:18 ait sshd[319645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 17:30:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
description:
Jan 29 17:30:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-29 17:30:35 dovecot_login authenticator failed for (undefined.hostname.localhost) [182.76.87.90]:35944: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 29 17:31:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.41.69.130
description:
Jan 29 17:31:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.41.69.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.41.69.130
description:
2025-01-29 17:31:04 dovecot_plain authenticator failed for syn-047-041-069-130.res.spectrum.com [47.41.69.130]:43526: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 17:31:06 ait sshd[320127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.209
description:
Jan 29 17:31:29 ait sshd[320396]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.2
description:
Jan 29 17:31:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 17:31:06 ait sshd[320127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.100.7.232
description:
[2025-01-29 17:31:08 +0100] info [webmaild] 179.100.7.232 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.35
description:
[2025-01-29 17:31:23 +0100] info [webmaild] 213.230.86.35 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.209
description:
Jan 29 17:31:29 ait sshd[320396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.209  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.2
description:
2025-01-29 17:31:32 dovecot_plain authenticator failed for ([222.180.2.2]) [222.180.2.2]:33775: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 17:30:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.209
description:
Jan 29 17:31:46 ait sshd[320396]: error: maximum authentication attempts exceeded for root from 218.92.0.209 port 10932 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 17:32:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.209
description:
Jan 29 17:31:40 ait sshd[320396]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 17:33:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.109.57.212
description:
[2025-01-29 17:33:14 +0100] info [webmaild] 103.109.57.212 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.222.71.48
description:
[2025-01-29 17:32:56 +0100] info [webmaild] 102.222.71.48 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 101.201.108.203
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-33.101.201.108.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.4.12
description:
[2025-01-29 17:34:50 +0100] info [webmaild] 38.25.4.12 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 29 17:34:38 ait sshd[322328]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 29 17:34:38 ait sshd[322328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.139.27.26
description:
[2025-01-29 17:35:19 +0100] info [webmaild] 181.139.27.26 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.77.94
description:
[2025-01-29 17:35:22 +0100] info [webmaild] 190.89.77.94 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.173.227
description:
[2025-01-29 17:35:15 +0100] info [webmaild] 177.125.173.227 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 114.31.27.150
description:
[2025-01-29 17:35:20 +0100] info [webmaild] 114.31.27.150 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.65.23
description:
[2025-01-29 17:35:56 +0100] info [webmaild] 169.224.65.23 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.183.94.243
description:
[2025-01-29 17:36:26 +0100] info [webmaild] 185.183.94.243 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.177.123.247
description:
[2025-01-29 17:37:04 +0100] info [webmaild] 160.177.123.247 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.109.122.233
description:
[2025-01-29 17:37:12 +0100] info [webmaild] 179.109.122.233 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 29 17:38:35 ait sshd[325104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 29 17:38:35 ait sshd[325104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 17:38:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.254.87.219
description:
Jan 29 17:38:40 ait sshd[325151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.254.87.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 17:39:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Jan 29 17:39:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.205.235.94
description:
Jan 29 17:38:37 ait sshd[325104]: Failed password for invalid user universitypublishing from 119.205.235.94 port 46256 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.13.206.31
description:
Jan 29 17:40:22 ait sshd[326288]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.13.206.31 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.13.206.31
description:
Jan 29 17:40:22 ait sshd[326288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.13.206.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 29 17:40:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-29 17:40:29 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:40813: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-01-29 17:39:37 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:35540: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
description:
Jan 29 17:39:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
description:
2025-01-29 17:39:49 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:33003: 535 Incorrect authentication data (set_id=ofei)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.153.96.146
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-41.54.153.96.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
description:
Jan 29 17:40:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-01-29 17:40:44 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:46726: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.254.87.219
description:
Jan 29 17:40:48 ait sshd[326570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.254.87.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 17:41:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 17:41:25 ait sshd[326943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.227.193
description:
[2025-01-29 17:41:25 +0100] info [webmaild] 177.37.227.193 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.179.163
description:
[2025-01-29 17:40:44 +0100] info [webmaild] 186.233.179.163 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 17:41:24 ait sshd[326943]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.13.206.31
description:
Jan 29 17:42:30 ait sshd[327697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.13.206.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 29 17:41:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-29 17:41:48 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:39626: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 29 17:42:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-29 17:42:28 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:63258: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.13.206.31
description:
Jan 29 17:42:30 ait sshd[327697]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.13.206.31 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.254.87.219
description:
Jan 29 17:42:03 ait sshd[327494]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.254.87.219


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.87.219
description:
Jan 29 17:42:05 ait sshd[327494]: Failed password for invalid user user1 from 94.254.87.219 port 57386 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.105.241
description:
Jan 29 17:42:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.105.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
description:
Jan 29 17:42:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
description:
2025-01-29 17:42:13 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:35108: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.105.241
description:
2025-01-29 17:42:10 dovecot_plain authenticator failed for ([163.179.105.241]) [163.179.105.241]:57754: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.175.88.211
description:
[2025-01-29 17:43:25 +0100] info [webmaild] 212.175.88.211 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.110.209
description:
[2025-01-29 17:43:53 +0100] info [webmaild] 177.67.110.209 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.29.92
description:
Jan 29 17:44:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.29.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.13.206.31
description:
Jan 29 17:44:17 ait sshd[328620]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.13.206.31 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.13.206.31
description:
Jan 29 17:44:17 ait sshd[328620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.13.206.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.29.92
description:
2025-01-29 17:44:20 dovecot_plain authenticator failed for ([188.59.29.92]) [188.59.29.92]:38944: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.111.159.125
description:
[2025-01-29 17:45:19 +0100] info [webmaild] 187.111.159.125 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
description:
Jan 29 17:44:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
description:
2025-01-29 17:44:53 dovecot_plain authenticator failed for ([103.59.134.177]) [103.59.134.177]:10085: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.127.134.129
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-45.103.127.134.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 43.246.202.238
description:
[2025-01-29 17:45:16 +0100] info [webmaild] 43.246.202.238 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
description:
Jan 29 17:45:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-29 17:45:57 dovecot_plain authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:34165: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
description:
2025-01-29 17:45:49 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:25844: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 29 17:45:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 17:46:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.54.41.215
description:
[2025-01-29 17:46:25 +0100] info [webmaild] 197.54.41.215 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
description:
2025-01-29 17:47:31 dovecot_login authenticator failed for ([60.172.41.103]) [60.172.41.103]:47256: 535 Incorrect authentication data (set_id=iric@aitopen.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.103.242.57
description:
[2025-01-29 17:46:59 +0100] info [webmaild] 46.103.242.57 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.68.248.239
description:
[2025-01-29 17:47:19 +0100] info [webmaild] 177.68.248.239 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.245.175.4
description:
[2025-01-29 17:47:26 +0100] info [webmaild] 105.245.175.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
description:
Jan 29 17:47:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.156.250.100
description:
[2025-01-29 17:47:58 +0100] info [webmaild] 189.156.250.100 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.153.113.181
description:
[2025-01-29 17:47:38 +0100] info [webmaild] 190.153.113.181 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.3.140.28
description:
Jan 29 17:47:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.3.140.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.3.140.28
description:
2025-01-29 17:47:42 dovecot_login authenticator failed for ([106.3.140.28]) [106.3.140.28]:57810: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.176.8.126
description:
[2025-01-29 17:49:12 +0100] info [webmaild] 189.176.8.126 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
description:
Jan 29 17:49:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
description:
2025-01-29 17:49:30 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:46962: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.61.240.148
description:
[2025-01-29 17:48:38 +0100] info [webmaild] 103.61.240.148 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
description:
2025-01-29 17:49:00 dovecot_plain authenticator failed for (2-55-85-196.orange.net.il) [2.55.85.196]:60704: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 17:49:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.182.89
description:
[2025-01-29 17:49:21 +0100] info [webmaild] 45.160.182.89 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.27.252
description:
47.128.27.252 - - [29/Jan/2025:17:48:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11991182 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/data/buy-photoshop-cs6-extended-mac.php" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.27.252


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.63.31
description:
47.128.63.31 - - [29/Jan/2025:17:50:08 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17686381 HTTP/2.0" 302 0 gou.university "https://gou.university/course-category/data-analysis/?filter_course-category=61%2C106%2C205%2C125&filter_course-language=121%2C79&filtering=1&instructor=2%2C1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.63.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 17:51:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.54.110
description:
[2025-01-29 17:52:06 +0100] info [webmaild] 45.186.54.110 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-52.104.209.253.237


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 17:52:58 ait sshd[333977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 17:52:58 ait sshd[333977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.184.119.106
description:
Jan 29 17:53:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.184.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.236.239.19
description:
[2025-01-29 17:53:29 +0100] info [webmaild] 176.236.239.19 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Jan 29 17:53:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-01-29 17:53:40 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:38175: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Jan 29 17:53:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-01-29 17:53:50 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:59338: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 17:54:25 ait sshd[334887]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 17:54:25 ait sshd[334887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-01-29 17:55:31 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:44518: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.84.81.147
description:
[2025-01-29 17:55:35 +0100] info [webmaild] 206.84.81.147 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Jan 29 17:55:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.184.40.235
description:
Jan 29 17:56:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.184.40.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.221.104.33
description:
Jan 29 17:55:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.221.104.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.221.104.33
description:
2025-01-29 17:55:47 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:60482: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.171.206.117
description:
[2025-01-29 17:56:02 +0100] info [webmaild] 83.171.206.117 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-01-29 17:57:24 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:54120: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.9.200
description:
[2025-01-29 17:57:31 +0100] info [webmaild] 102.0.9.200 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Jan 29 17:57:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.208.81.44
description:
[2025-01-29 17:57:36 +0100] info [webmaild] 181.208.81.44 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Jan 29 17:57:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-01-29 17:57:34 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:47424: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-01-29 17:57:35 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:54416: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Jan 29 17:57:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-01-29 17:57:14 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:44954: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Jan 29 17:57:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.207.10
description:
Jan 29 17:57:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.207.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-01-29 17:57:58 dovecot_login authenticator failed for (95.0.252.78.static.ttnet.com.tr) [95.0.252.78]:60690: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Jan 29 17:58:08 ait sshd[337099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=gvu


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Jan 29 17:58:08 ait sshd[337099]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.232.148.114
description:
[2025-01-29 17:57:39 +0100] info [webmaild] 41.232.148.114 - vondee@ait.edu.gh "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.247.29.206
description:
[2025-01-29 17:57:45 +0100] info [webmaild] 170.247.29.206 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.207.10
description:
2025-01-29 17:57:49 dovecot_login authenticator failed for 213-154-207-10.static.vega-ua.net [213.154.207.10]:54002: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Jan 29 17:57:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 29 17:59:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.237.132
description:
[2025-01-29 17:59:10 +0100] info [webmaild] 179.108.237.132 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 17:59:13 ait sshd[337621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.34.159
description:
[2025-01-29 17:59:21 +0100] info [webmaild] 179.6.34.159 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 17:59:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 220.158.233.157
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-59.220.158.233.157


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
description:
2025-01-29 17:58:58 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:56438: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-29 17:59:09 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:40848: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 17:59:13 ait sshd[337621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Jan 29 17:58:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.155.105.223
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-58.104.155.105.223


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.49.244.8
description:
[2025-01-29 17:59:53 +0100] info [webmaild] 187.49.244.8 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.249.162
description:
[2025-01-29 18:00:13 +0100] info [webmaild] 45.190.249.162 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.19.174.89
description:
[2025-01-29 17:59:39 +0100] info [webmaild] 191.19.174.89 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 29 18:01:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 29 18:01:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-29 18:01:15 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:35812: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
description:
2025-01-29 18:01:24 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:33138: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 29 18:01:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
description:
Jan 29 18:01:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.249.182
description:
[2025-01-29 18:01:08 +0100] info [webmaild] 177.125.249.182 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.88.10.10
description:
Jan 29 18:01:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.88.10.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
description:
2025-01-29 18:01:27 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:46544: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-29 18:01:28 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:38760: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.246.240.84
description:
Jan 29 18:01:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.246.240.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 18:01:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-29 18:01:16 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:43286: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.246.240.84
description:
2025-01-29 18:01:21 dovecot_login authenticator failed for ([213.246.240.84]) [213.246.240.84]:42803: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
description:
2025-01-29 18:01:35 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:33951: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.240.34.230
description:
[2025-01-29 18:01:02 +0100] info [webmaild] 197.240.34.230 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
description:
Jan 29 18:01:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 29 18:01:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-29 18:01:33 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:56606: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-01-29 18:02:19 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:50249: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Jan 29 18:02:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-01-29 18:02:29 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:35083: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.114.252
description:
[2025-01-29 18:01:44 +0100] info [webmaild] 213.230.114.252 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Jan 29 18:02:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.40.203
description:
Jan 29 18:03:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.40.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.40.203
description:
2025-01-29 18:03:18 dovecot_plain authenticator failed for ([120.238.40.203]) [120.238.40.203]:58016: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
description:
Jan 29 18:02:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-01-29 18:02:57 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:44613: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 18:03:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-03.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.59.147.53
description:
[2025-01-29 18:03:12 +0100] info [webmaild] 5.59.147.53 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.26.98
description:
Jan 29 18:04:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.26.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.34
description:
Jan 29 18:04:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.193
description:
Jan 29 18:04:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 18:03:59 ait sshd[339810]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
description:
2025-01-29 18:04:22 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:33634: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
description:
2025-01-29 18:04:30 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:35132: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.193
description:
2025-01-29 18:04:32 dovecot_plain authenticator failed for 110-25-104-193.adsl.fetnet.net [110.25.104.193]:41567: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 18:03:59 ait sshd[339810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
description:
Jan 29 18:04:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
description:
2025-01-29 18:05:14 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:37966: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.11.124
description:
[2025-01-29 18:05:33 +0100] info [webmaild] 169.224.11.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 29 18:05:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 29 18:05:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Jan 29 18:04:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-29 18:04:47 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:42757: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.220.118.201
description:
2025-01-29 18:05:06 dovecot_login authenticator failed for 178-220-118-201.static.isp.telekom.rs [178.220.118.201]:56415: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
description:
Jan 29 18:05:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 18:05:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
description:
2025-01-29 18:04:53 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:35625: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.220.118.201
description:
Jan 29 18:05:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.220.118.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 29 18:05:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-29 18:05:51 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:48293: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 18:06:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-29 18:05:37 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:53448: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-29 18:05:37 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:33936: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-29 18:07:13 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:40338: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-29 18:07:30 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:54400: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Jan 29 18:06:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-29 18:07:20 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:53290: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.139
description:
2025-01-29 18:06:43 dovecot_plain authenticator failed for (92.62.243.139.fibermax.bg) [92.62.243.139]:60705: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 29 18:07:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 29 18:07:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
description:
2025-01-29 18:07:23 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:36097: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 29 18:07:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-01-29 18:06:54 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:36415: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.76.106.226
description:
Jan 29 18:07:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.76.106.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 114.130.98.254
description:
[2025-01-29 18:07:49 +0100] info [webmaild] 114.130.98.254 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 29 18:08:32 ait sshd[341765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.76.222
description:
[2025-01-29 18:08:15 +0100] info [webmaild] 213.230.76.222 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.127.113
description:
47.128.127.113 - - [29/Jan/2025:18:08:23 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20588118 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106&filter_course-language=198%2C79%2C183%2C99%2C121&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.127.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 29 18:08:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-29 18:08:27 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:2032: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.166.212.246
description:
[2025-01-29 18:08:48 +0100] info [webmaild] 38.166.212.246 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 29 18:09:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-29 18:09:21 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:47250: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.222.244.89
description:
Jan 29 18:08:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.222.244.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
description:
2025-01-29 18:08:59 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:49325: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-01-29 18:09:08 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:55181: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.195.38
description:
Jan 29 18:09:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.195.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-29 18:09:17 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:45564: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.148.106
description:
Jan 29 18:08:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.148.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.2.202
description:
Jan 29 18:09:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.2.202
description:
2025-01-29 18:09:32 dovecot_login authenticator failed for ([221.224.2.202]) [221.224.2.202]:40220: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-29 18:09:35 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:41820: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.222.244.89
description:
2025-01-29 18:08:41 dovecot_login authenticator failed for (89.244.222.60.adsl-pool.sx.cn) [60.222.244.89]:56465: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 29 18:09:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 29 18:09:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.195.38
description:
2025-01-29 18:09:19 dovecot_login authenticator failed for ([190.121.195.38]) [190.121.195.38]:60760: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 29 18:09:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.126.16
description:
[2025-01-29 18:09:54 +0100] info [webmaild] 143.202.126.16 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.216.198.219
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-10.195.216.198.219


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.220.161
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-10.157.245.220.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 29 18:09:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-29 18:09:49 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:59654: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.250.237.60
description:
[2025-01-29 18:09:57 +0100] info [webmaild] 179.250.237.60 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-29 18:10:33 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:1291: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Jan 29 18:10:16 ait sshd[342378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 29 18:10:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-29 18:10:53 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:35248: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-01-29 18:11:05 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:43212: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-01-29 18:11:08 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:47974: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.4.130
description:
[2025-01-29 18:11:27 +0100] info [webmaild] 45.163.4.130 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Jan 29 18:10:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.101
description:
2025-01-29 18:11:24 dovecot_login authenticator failed for st7013.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.101]:47758: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.101
description:
Jan 29 18:11:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-29 18:11:00 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:54580: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
description:
2025-01-29 18:11:14 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:56305: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 29 18:10:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 29 18:10:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
description:
Jan 29 18:11:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-29 18:11:26 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:54498: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 29 18:10:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
description:
Jan 29 18:10:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-29 18:11:01 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (astaptest) [109.164.246.53]:38481: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-01-29 18:10:46 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:33984: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Jan 29 18:11:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
description:
2025-01-29 18:10:45 dovecot_login authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:59767: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Jan 29 18:11:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.76.185
description:
[2025-01-29 18:11:15 +0100] info [webmaild] 189.37.76.185 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 29 18:11:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
description:
Jan 29 18:12:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-29 18:12:01 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:43431: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-01-29 18:12:12 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:47314: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.19.123.165
description:
[2025-01-29 18:12:27 +0100] info [webmaild] 186.19.123.165 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.199.245
description:
2025-01-29 18:11:38 dovecot_login authenticator failed for 5.185.199.245.ipv4.public.orange.pl [5.185.199.245]:41700: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.199.245
description:
Jan 29 18:11:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.199.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
description:
Jan 29 18:11:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Jan 29 18:12:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 29 18:12:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-29 18:12:29 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:59214: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-29 18:11:39 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:61291: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.188.178.101
description:
[2025-01-29 18:11:53 +0100] info [webmaild] 181.188.178.101 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.186.253.229
description:
[2025-01-29 18:12:18 +0100] info [webmaild] 91.186.253.229 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 29 18:11:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-01-29 18:12:16 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:40918: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-01-29 18:12:51 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:45882: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.190.202.165
description:
[2025-01-29 18:13:00 +0100] info [webmaild] 78.190.202.165 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.122.205.217
description:
[2025-01-29 18:13:28 +0100] info [webmaild] 181.122.205.217 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.228.181.34
description:
Jan 29 18:12:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.228.181.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.228.181.34
description:
2025-01-29 18:12:40 dovecot_plain authenticator failed for ([207.228.181.34]) [207.228.181.34]:38101: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Jan 29 18:12:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.227.39.71
description:
[2025-01-29 18:14:18 +0100] info [webmaild] 186.227.39.71 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.77
description:
Jan 29 18:14:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.77
description:
2025-01-29 18:14:35 dovecot_login authenticator failed for ([111.61.176.77]) [111.61.176.77]:44188: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
description:
Jan 29 18:14:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-01-29 18:14:04 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:52822: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.144.205
description:
[2025-01-29 18:14:11 +0100] info [webmaild] 131.196.144.205 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Jan 29 18:14:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-01-29 18:14:15 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:52783: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-29 18:15:33 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:40346: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-29 18:15:15 dovecot_login authenticator failed for (nsg-static-250.173.71.182.airtel.in) [182.71.173.250]:47398: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-01-29 18:15:25 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:25532: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
description:
2025-01-29 18:15:29 dovecot_plain authenticator failed for ([178.178.194.203]) [178.178.194.203]:39100: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
description:
Jan 29 18:15:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 188.245.228.175
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-15.188.245.228.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
description:
Jan 29 18:15:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 29 18:15:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 29 18:15:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-29 18:15:19 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:38338: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Jan 29 18:15:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
description:
Jan 29 18:15:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
description:
2025-01-29 18:14:47 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:40591: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
description:
Jan 29 18:14:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
description:
2025-01-29 18:15:23 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:41747: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 29 18:15:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
description:
Jan 29 18:15:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.21.235.162
description:
Jan 29 18:14:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.21.235.162 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 208.109.244.174
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-14.208.109.244.174


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
description:
2025-01-29 18:14:57 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:30756: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
description:
2025-01-29 18:15:34 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:58628: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-01-29 18:15:50 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:35178: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 101.133.163.146
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-16.101.133.163.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
description:
Jan 29 18:16:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
description:
2025-01-29 18:15:38 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:51804: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-29 18:15:40 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:60760: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 29 18:15:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-29 18:15:44 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:40219: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.88.104
description:
2025-01-29 18:15:57 dovecot_login authenticator failed for ([1.235.88.104]) [1.235.88.104]:35253: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
description:
2025-01-29 18:16:23 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:29942: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 18:16:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 29 18:16:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
description:
Jan 29 18:16:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-29 18:16:34 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:15376: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
description:
2025-01-29 18:16:36 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:38726: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Jan 29 18:15:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Jan 29 18:15:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-29 18:15:47 dovecot_login authenticator failed for (m121-202-152-165.smartone.com) [121.202.152.165]:35408: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.88.104
description:
Jan 29 18:15:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.88.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 29 18:15:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.89.146
description:
Jan 29 18:17:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.89.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-29 18:16:46 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:41510: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-29 18:16:47 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:36670: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-17.103.249.112.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 29 18:16:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-01-29 18:17:00 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:7882: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Jan 29 18:16:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-29 18:16:59 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:56682: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.170
description:
2025-01-29 18:17:14 dovecot_login authenticator failed for ([104.241.235.170]) [104.241.235.170]:45609: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-29 18:17:09 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:45050: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.235.170
description:
Jan 29 18:17:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.235.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
description:
2025-01-29 18:17:37 dovecot_login authenticator failed for ([58.18.89.146]) [58.18.89.146]:50808: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 29 18:16:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 29 18:16:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 29 18:17:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-29 18:18:00 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:60042: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-01-29 18:18:02 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:29081: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-29 18:17:46 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:52057: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 29 18:17:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Jan 29 18:18:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.66.151.124
description:
[2025-01-29 18:18:00 +0100] info [webmaild] 102.66.151.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.52
description:
Jan 29 18:18:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.52
description:
2025-01-29 18:18:35 dovecot_login authenticator failed for ([103.146.233.52]) [103.146.233.52]:45690: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 29 18:17:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 29 18:19:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-29 18:19:30 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:48716: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-29 18:19:34 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:3440: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.80.220.155
description:
2025-01-29 18:19:25 dovecot_login authenticator failed for mobile-107-80-220-155.mycingular.net [107.80.220.155]:39465: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.62.3
description:
2025-01-29 18:18:57 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:52846: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 29 18:19:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.228.113
description:
2025-01-29 18:19:27 dovecot_login authenticator failed for l228113.ppp.asahi-net.or.jp [218.219.228.113]:43416: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-01-29 18:18:44 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:50406: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-29 18:19:17 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:42737: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 18:19:22 ait sshd[348999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.219.228.113
description:
Jan 29 18:19:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.219.228.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.62.3
description:
Jan 29 18:18:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.62.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Jan 29 18:18:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.80.220.155
description:
Jan 29 18:19:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.80.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 29 18:19:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
description:
2025-01-29 18:19:50 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:34921: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 29 18:19:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
description:
2025-01-29 18:20:20 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:54103: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 18:20:36 dovecot_plain authenticator failed for (belfoly) [109.166.70.166]:55244: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
description:
Jan 29 18:19:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Jan 29 18:19:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.230.190
description:
[2025-01-29 18:20:00 +0100] info [webmaild] 38.156.230.190 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-29 18:19:59 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:59426: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Jan 29 18:20:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-29 18:20:01 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:41298: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 29 18:19:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-29 18:19:48 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:38028: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-29 18:19:49 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:44715: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.178.5
description:
[2025-01-29 18:19:59 +0100] info [webmaild] 186.233.178.5 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-29 18:19:44 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:54829: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 29 18:19:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 29 18:19:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.155.47
description:
[2025-01-29 18:20:31 +0100] info [webmaild] 186.224.155.47 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 18:20:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 29 18:20:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 29 18:21:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-01-29 18:21:22 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:63416: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Jan 29 18:20:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-01-29 18:20:40 dovecot_plain authenticator failed for (omnont) [102.53.15.180]:59617: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-29 18:20:43 dovecot_plain authenticator failed for (copty) [102.53.15.54]:33665: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-29 18:21:24 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:15155: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Jan 29 18:21:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.137.21
description:
Jan 29 18:21:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.137.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.180.216.252
description:
[2025-01-29 18:21:54 +0100] info [webmaild] 187.180.216.252 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.137.21
description:
2025-01-29 18:21:38 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:38098: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.212.217.38
description:
[2025-01-29 18:22:12 +0100] info [webmaild] 190.212.217.38 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
description:
Jan 29 18:22:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
description:
2025-01-29 18:22:53 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:32110: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Jan 29 18:22:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-29 18:23:18 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:33952: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
description:
2025-01-29 18:23:00 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:57405: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
description:
2025-01-29 18:23:08 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:55089: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 29 18:23:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
description:
Jan 29 18:23:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.72.173
description:
[2025-01-29 18:23:12 +0100] info [webmaild] 177.131.72.173 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.232.243.149
description:
[2025-01-29 18:23:31 +0100] info [webmaild] 181.232.243.149 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 29 18:24:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 29 18:24:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-29 18:24:18 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38609: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.61.250
description:
[2025-01-29 18:23:56 +0100] info [webmaild] 45.70.61.250 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-29 18:24:07 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:53734: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.133.76.17
description:
[2025-01-29 18:24:26 +0100] info [webmaild] 5.133.76.17 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 29 18:24:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-29 18:24:31 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:58786: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.123.252.145
description:
[2025-01-29 18:25:36 +0100] info [webmaild] 27.123.252.145 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
description:
2025-01-29 18:26:05 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:44032: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-01-29 18:26:24 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:18002: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 18:25:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-29 18:26:01 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:39530: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.245.37
description:
Jan 29 18:25:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.245.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.63.82
description:
[2025-01-29 18:25:51 +0100] info [webmaild] 181.199.63.82 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 29 18:26:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-29 18:26:12 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:56875: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Jan 29 18:26:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 29 18:26:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.245.37
description:
2025-01-29 18:25:51 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:5838: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.233.119
description:
[2025-01-29 18:25:54 +0100] info [webmaild] 177.66.233.119 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 29 18:25:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
description:
Jan 29 18:26:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-29 18:26:24 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:40183: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-01-29 18:27:28 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:36642: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.163.171
description:
[2025-01-29 18:26:36 +0100] info [webmaild] 37.237.163.171 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 29 18:26:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-29 18:26:55 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:40681: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-29 18:26:55 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:44266: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 29 18:26:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 18:27:06 ait sshd[354756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 29 18:26:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 29 18:26:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-29 18:26:42 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:49596: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-29 18:26:42 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:27199: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Jan 29 18:27:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.183.114.175
description:
Jan 29 18:26:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.183.114.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.183.114.175
description:
2025-01-29 18:26:42 dovecot_plain authenticator failed for ([179.183.114.175]) [179.183.114.175]:34419: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 29 18:26:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
description:
Jan 29 18:26:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-29 18:26:38 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:47063: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
description:
2025-01-29 18:26:39 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (dulantrign) [78.68.37.25]:47968: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 18:27:06 ait sshd[354756]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
description:
2025-01-29 18:27:40 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:33671: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.246.89.195
description:
Jan 29 18:28:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.246.89.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.89.195
description:
2025-01-29 18:28:13 dovecot_plain authenticator failed for ([183.246.89.195]) [183.246.89.195]:40082: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
description:
Jan 29 18:27:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Jan 29 18:28:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-01-29 18:28:03 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:54738: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 29 18:29:05 ait sshd[356017]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Jan 29 18:29:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.145
description:
Jan 29 18:28:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 18:28:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-29 18:29:01 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:52140: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-29 18:29:04 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:58213: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.237.145
description:
2025-01-29 18:28:42 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.237.145]:28258: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-29 18:28:51 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:60700: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 29 18:28:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 29 18:29:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-29 18:29:17 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:49992: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-01-29 18:29:18 dovecot_login authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:37122: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 29 18:29:05 ait sshd[356017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 29 18:28:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.232.123.59
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:dgyan@ait.edu.gh||WPU:dgyan@ait.edu.gh||RSV:6.65||T:APACHE||MV:18-28.213.232.123.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.93
description:
Jan 29 18:29:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 18:29:55 ait sshd[356627]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 18:29:55 ait sshd[356627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.49.87
description:
[2025-01-29 18:30:18 +0100] info [webmaild] 186.219.49.87 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 29 18:31:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-29 18:31:04 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:47426: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 29 18:31:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-29 18:31:18 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:55156: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.97.156
description:
[2025-01-29 18:30:53 +0100] info [webmaild] 128.201.97.156 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 18:31:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-29 18:32:00 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:30554: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Jan 29 18:31:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-29 18:31:45 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:50254: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 29 18:31:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.120.177.231
description:
[2025-01-29 18:32:07 +0100] info [webmaild] 45.120.177.231 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 29 18:33:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 18:33:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Jan 29 18:33:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.141.62
description:
[2025-01-29 18:32:44 +0100] info [webmaild] 119.160.141.62 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-29 18:33:12 dovecot_login authenticator failed for ([14.97.143.225]) [182.71.173.250]:33736: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-29 18:33:16 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:55050: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-01-29 18:33:04 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:40622: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 18:32:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.7.10
description:
Jan 29 18:32:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.7.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-01-29 18:33:01 dovecot_login authenticator failed for ([120.194.7.10]) [120.194.7.10]:36151: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 29 18:33:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 29 18:33:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-01-29 18:33:43 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:54765: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Jan 29 18:33:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-01-29 18:33:48 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:36295: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.99.85
description:
[2025-01-29 18:33:57 +0100] info [webmaild] 45.187.99.85 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-29 18:33:37 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:35418: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Jan 29 18:33:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 18:34:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.210.128
description:
[2025-01-29 18:34:41 +0100] info [webmaild] 45.71.210.128 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.163.103
description:
Jan 29 18:34:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.163.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-29 18:34:38 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:53102: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Jan 29 18:35:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.67.56.2
description:
[2025-01-29 18:35:23 +0100] info [webmaild] 102.67.56.2 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.180.93.208
description:
2025-01-29 18:35:29 dovecot_plain authenticator failed for ([182.180.93.208]) [182.180.93.208]:51239: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Jan 29 18:34:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Jan 29 18:34:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-01-29 18:34:49 dovecot_login authenticator failed for syn-098-010-121-246.res.spectrum.com (098-010-121-246.res.spectrum.com) [98.10.121.246]:48252: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
description:
2025-01-29 18:35:02 dovecot_login authenticator failed for ([121.154.90.17]) [121.154.90.17]:36660: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 29 18:34:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-01-29 18:34:48 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:52430: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 29 18:34:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.180.93.208
description:
Jan 29 18:35:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.180.93.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-29 18:35:54 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:7669: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.6.7
description:
[2025-01-29 18:35:59 +0100] info [webmaild] 181.191.6.7 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-29 18:35:59 dovecot_login authenticator failed for (170.250.152.88.hwccustomers.com) [170.250.152.88]:46242: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 29 18:36:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 29 18:36:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Jan 29 18:36:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-01-29 18:36:31 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:51359: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 29 18:35:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.141.101.237
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:18-35.94.141.101.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 29 18:35:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 29 18:36:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-29 18:36:03 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:34620: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.187.1.60
description:
[2025-01-29 18:36:18 +0100] info [webmaild] 94.187.1.60 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.133.161
description:
2025-01-29 18:35:39 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [122.176.133.161]:43121: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.163.242.126
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:18-35.95.163.242.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.199.50
description:
[2025-01-29 18:35:47 +0100] info [webmaild] 131.0.199.50 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-29 18:36:13 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:38624: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-29 18:36:33 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:36473: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.133.161
description:
Jan 29 18:35:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.133.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.183.220
description:
Jan 29 18:37:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.183.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 18:36:47 ait sshd[362559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
description:
2025-01-29 18:36:47 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:53060: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.227.65.234
description:
[2025-01-29 18:37:09 +0100] info [webmaild] 177.227.65.234 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 29 18:37:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-29 18:37:30 dovecot_login authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:54942: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
description:
Jan 29 18:36:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 18:36:47 ait sshd[362559]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.234.69
description:
2025-01-29 18:37:18 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:44712: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.234.69
description:
Jan 29 18:37:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.234.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.183.220
description:
2025-01-29 18:37:29 dovecot_plain authenticator failed for ([157.122.183.220]) [157.122.183.220]:44031: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.106.98.103
description:
[2025-01-29 18:36:35 +0100] info [webmaild] 85.106.98.103 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Jan 29 18:36:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-01-29 18:36:47 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:43344: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.34.173.78
description:
[2025-01-29 18:37:04 +0100] info [webmaild] 179.34.173.78 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.184.94.8
description:
[2025-01-29 18:38:12 +0100] info [webmaild] 103.184.94.8 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 29 18:37:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 29 18:37:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 18:37:56 ait sshd[363703]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 18:37:56 ait sshd[363703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Jan 29 18:38:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-01-29 18:38:07 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:41717: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-01-29 18:38:07 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:33492: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.254
description:
47.128.50.254 - - [29/Jan/2025:18:38:19 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19855645 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?filter_course-language=99&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 29 18:38:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 29 18:37:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
description:
2025-01-29 18:37:43 dovecot_login authenticator failed for ([111.61.176.243]) [111.61.176.243]:16438: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.149.46
description:
Jan 29 18:37:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.149.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-29 18:37:58 dovecot_login authenticator failed for ([103.178.158.132]) [103.178.158.132]:46512: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 18:38:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-29 18:37:58 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:19677: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Jan 29 18:38:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-29 18:39:32 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:49575: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 29 18:39:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


