# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 22:17:08 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.224.120
description:
[2025-01-28 22:16:43 +0100] info [webmaild] 177.72.224.120 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 28 22:17:00 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-01-28 22:18:15 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:35348: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 22:18:15 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-01-28 22:18:27 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:45258: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
description:
2025-01-28 22:17:41 dovecot_plain authenticator failed for data.autofrant.ru (mensh) [151.248.116.230]:41954: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Jan 28 22:18:13 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-01-28 22:18:05 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:43452: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 22:18:34 ait sshd[3942443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Jan 28 22:18:25 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Jan 28 22:18:03 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-28 22:18:17 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:51862: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-28 22:18:10 dovecot_plain authenticator failed for (rearchings) [149.0.16.4]:60488: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 28 22:18:15 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 22:18:16 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 22:17:54 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.170.39
description:
[2025-01-28 22:18:00 +0100] info [webmaild] 177.67.170.39 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 28 22:19:11 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-28 22:19:13 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:56968: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 22:19:18 ait sshd[3942709]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 22:19:18 ait sshd[3942709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.241.169.186
description:
[2025-01-28 22:19:32 +0100] info [webmaild] 177.241.169.186 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-01-28 22:19:02 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:56877: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
description:
Jan 28 22:19:11 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Jan 28 22:19:00 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
description:
2025-01-28 22:19:13 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:42850: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 28 22:18:54 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-28 22:18:56 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:18076: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 22:20:15 dovecot_plain authenticator failed for (plicist) [46.30.161.197]:46191: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.52.218
description:
2025-01-28 22:19:50 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no (cemajag) [94.246.52.218]:52771: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 22:20:13 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.183.1.139
description:
[2025-01-28 22:20:15 +0100] info [webmaild] 201.183.1.139 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 22:20:44 ait sshd[3943319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=aitopen


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 22:21:23 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 22:20:44 ait sshd[3943319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 28 22:21:36 ait sshd[3943678]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.80.25.198
description:
[2025-01-28 22:21:54 +0100] info [webmaild] 181.80.25.198 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.63.227.69
description:
[2025-01-28 22:21:56 +0100] info [webmaild] 189.63.227.69 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 22:22:09 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (gnousism) [51.255.84.180]:58484: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.234.166
description:
[2025-01-28 22:22:12 +0100] info [webmaild] 168.0.234.166 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.10.213.78
description:
[2025-01-28 22:23:27 +0100] info [webmaild] 189.10.213.78 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.188.109.105
description:
[2025-01-28 22:22:46 +0100] info [webmaild] 186.188.109.105 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.111
description:
Jan 28 22:23:21 ait sshd[3944555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.14
description:
Jan 28 22:23:26 ait sshd[3944572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.14
description:
Jan 28 22:23:26 ait sshd[3944572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.136.224
description:
[2025-01-28 22:23:20 +0100] info [webmaild] 45.238.136.224 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 28 22:23:21 ait sshd[3944555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.242.2
description:
[2025-01-28 22:23:43 +0100] info [webmaild] 201.182.242.2 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.251.106.99
description:
[2025-01-28 22:23:53 +0100] info [webmaild] 179.251.106.99 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 22:24:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.230.214.243
description:
Jan 28 22:24:38 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.230.214.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.230.214.243
description:
2025-01-28 22:24:40 dovecot_plain authenticator failed for c-85-230-214-243.bbcust.telenor.se (balanistic) [85.230.214.243]:60315: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.99.44.86
description:
Jan 28 22:25:29 ait sshd[3945559]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.99.44.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.23.44
description:
[2025-01-28 22:25:17 +0100] info [webmaild] 170.150.23.44 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.76.181.237
description:
Jan 28 22:25:20 ait sshd[3945336]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.76.181.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.181.237
description:
Jan 28 22:25:20 ait sshd[3945336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.181.237


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.99.44.86
description:
Jan 28 22:25:29 ait sshd[3945559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.99.44.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 22:26:31 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Jan 28 22:25:58 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-01-28 22:26:00 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:53487: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Jan 28 22:26:08 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-01-28 22:26:10 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:35586: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-01-28 22:26:14 dovecot_plain authenticator failed for ([110.35.63.30]) [110.35.63.30]:57972: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.14
description:
Jan 28 22:26:15 ait sshd[3945855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 28 22:26:23 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 28 22:26:02 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Jan 28 22:26:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
description:
Jan 28 22:26:17 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-28 22:26:25 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:36808: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 22:26:33 dovecot_plain authenticator failed for (hirean) [147.235.97.158]:28367: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-28 22:26:04 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:33655: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.14
description:
Jan 28 22:26:15 ait sshd[3945855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-01-28 22:26:19 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:58346: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.172.130.191
description:
Jan 28 22:26:42 ait sshd[3946031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.172.130.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.155.53.141
description:
Jan 28 22:27:33 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.155.53.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.155.53.141
description:
2025-01-28 22:27:35 dovecot_plain authenticator failed for ([49.231.234.142]) [122.155.53.141]:54808: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.172.130.191
description:
Jan 28 22:26:42 ait sshd[3946031]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.172.130.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 28 22:27:19 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.76.181.237
description:
Jan 28 22:27:25 ait sshd[3946382]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.76.181.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.181.237
description:
Jan 28 22:27:25 ait sshd[3946382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.181.237  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.111
description:
Jan 28 22:27:37 ait sshd[3946539]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.133.203.112
description:
[2025-01-28 22:27:14 +0100] info [webmaild] 212.133.203.112 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-28 22:27:21 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:53918: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 28 22:27:37 ait sshd[3946539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.186
description:
Jan 28 22:27:42 ait sshd[3946646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.186


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.49.152.14
description:
Jan 28 22:27:53 ait sshd[3946655]: Failed password for invalid user deploy from 187.49.152.14 port 34302 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.113.230.171
description:
[2025-01-28 22:27:56 +0100] info [webmaild] 188.113.230.171 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.35.249.157
description:
[2025-01-28 22:28:22 +0100] info [webmaild] 177.35.249.157 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-28 22:28:23 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:53343: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.240.89
description:
[2025-01-28 22:28:35 +0100] info [webmaild] 201.148.240.89 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.14
description:
Jan 28 22:27:51 ait sshd[3946655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 28 22:28:21 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.186
description:
Jan 28 22:27:42 ait sshd[3946646]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.14
description:
Jan 28 22:27:51 ait sshd[3946655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
description:
Jan 28 22:29:29 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
description:
2025-01-28 22:29:31 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:59254: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 22:29:31 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (suristed) [51.255.84.180]:34972: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 28 22:28:49 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-28 22:28:51 dovecot_plain authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:56886: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 22:29:29 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 28 22:29:40 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
description:
Jan 28 22:29:46 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
description:
2025-01-28 22:29:48 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:47020: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 28 22:29:50 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-28 22:29:52 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:57333: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-28 22:29:42 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:62097: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 28 22:30:46 ait sshd[3947869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.159.84
description:
[2025-01-28 22:30:49 +0100] info [webmaild] 45.185.159.84 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 28 22:30:46 ait sshd[3947869]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.214.161
description:
[2025-01-28 22:31:50 +0100] info [webmaild] 45.234.214.161 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 28 22:32:54 ait sshd[3948737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-28 22:32:55 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:50456: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-01-28 22:33:01 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:50622: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 28 22:33:09 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.52.218
description:
2025-01-28 22:33:34 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no (aluee) [94.246.52.218]:53706: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.85.143
description:
[2025-01-28 22:33:39 +0100] info [webmaild] 191.5.85.143 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 28 22:32:53 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Jan 28 22:32:59 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-28 22:33:11 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:33722: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-01-28 22:33:18 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:41560: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.246.120
description:
[2025-01-28 22:33:27 +0100] info [webmaild] 177.85.246.120 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
description:
Jan 28 22:33:16 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.105.221.90
description:
[2025-01-28 22:33:30 +0100] info [webmaild] 176.105.221.90 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.52.218
description:
Jan 28 22:33:32 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.52.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 28 22:32:54 ait sshd[3948737]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.145.127.141
description:
[2025-01-28 22:34:38 +0100] info [webmaild] 31.145.127.141 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.176.213
description:
[2025-01-28 22:33:50 +0100] info [webmaild] 187.19.176.213 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-01-28 22:35:39 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:34476: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.249.206
description:
[2025-01-28 22:35:20 +0100] info [webmaild] 45.5.249.206 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-01-28 22:34:52 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:51460: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.186
description:
Jan 28 22:35:32 ait sshd[3949927]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Jan 28 22:34:50 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 28 22:35:29 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Jan 28 22:35:37 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.107.86.226
description:
[2025-01-28 22:35:16 +0100] info [webmaild] 85.107.86.226 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.186
description:
Jan 28 22:35:32 ait sshd[3949927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.186


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-28 22:35:09 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:56458: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.99.23.122
domain: tracker.aitedu.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:22-35.139.99.23.122||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 28 22:35:07 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-28 22:35:31 dovecot_plain authenticator failed for (yorowee) [102.53.15.56]:34292: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.25.5.69
description:
[2025-01-28 22:35:11 +0100] info [webmaild] 181.25.5.69 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.114
description:
47.128.96.114 - - [28/Jan/2025:22:36:27 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16618300 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/14/?filter_course-language=95%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
description:
2025-01-28 22:35:50 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:35612: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.112.147
description:
2025-01-28 22:36:02 dovecot_plain authenticator failed for p65148-obmd01.osaka.ocn.ne.jp [180.7.112.147]:38079: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
description:
2025-01-28 22:36:14 dovecot_plain authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:56999: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
description:
Jan 28 22:35:48 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.112.147
description:
Jan 28 22:36:00 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.112.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
description:
Jan 28 22:36:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 28 22:37:28 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.170.6
description:
Jan 28 22:37:30 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.170.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.59.180.144
description:
[2025-01-28 22:36:43 +0100] info [webmaild] 5.59.180.144 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads16a00084y||WPU:ads16a00084y||RSV:6.65||T:APACHE||MV:22-37.170.205.31.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-01-28 22:36:50 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:60666: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 22:37:30 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:50332: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.170.6
description:
2025-01-28 22:37:32 dovecot_login authenticator failed for ([125.139.170.6]) [125.139.170.6]:47328: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Jan 28 22:36:48 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.50.72
description:
[2025-01-28 22:38:40 +0100] info [webmaild] 45.175.50.72 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Jan 28 22:37:41 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-28 22:38:08 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:44736: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
description:
Jan 28 22:38:38 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-01-28 22:37:43 dovecot_login authenticator failed for (m121-202-152-7.smartone.com) [121.202.152.7]:21166: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 28 22:38:06 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Jan 28 22:37:45 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-01-28 22:37:47 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:42105: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
description:
2025-01-28 22:38:40 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:35756: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 22:38:42 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-28 22:38:53 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:41171: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.124
description:
Jan 28 22:39:01 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.124
description:
2025-01-28 22:39:03 dovecot_plain authenticator failed for 111-70-32-124.emome-ip.hinet.net [111.70.32.124]:46224: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 22:39:06 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.96.68.186
description:
[2025-01-28 22:39:38 +0100] info [webmaild] 186.96.68.186 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 28 22:38:51 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.42.196
description:
Jan 28 22:38:57 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.42.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.42.196
description:
2025-01-28 22:38:59 dovecot_plain authenticator failed for 221-120-42-196.emome-ip.hinet.net [221.120.42.196]:54336: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.35.116.66
description:
[2025-01-28 22:39:16 +0100] info [webmaild] 177.35.116.66 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 22:39:08 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (peremple) [81.225.30.107]:36873: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 22:40:00 ait sshd[3951632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.33.136.24
description:
[2025-01-28 22:39:46 +0100] info [webmaild] 177.33.136.24 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 28 22:39:59 ait sshd[3951632]: Invalid user universitypublishing from 175.126.195.176 port 53297


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 22:40:00 ait sshd[3951632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.99.44.86
description:
Jan 28 22:41:04 ait sshd[3952401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.99.44.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 22:40:44 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 22:40:48 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 22:41:08 dovecot_plain authenticator failed for (quirceth) [46.30.161.197]:47493: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.99.44.86
description:
Jan 28 22:41:04 ait sshd[3952401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.99.44.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 22:41:06 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 28 22:41:45 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-28 22:41:47 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:33856: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.109.80
description:
[2025-01-28 22:42:15 +0100] info [webmaild] 157.100.109.80 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
description:
Jan 28 22:42:08 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-01-28 22:42:10 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:40036: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.172.130.191
description:
Jan 28 22:43:17 ait sshd[3953362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.172.130.191


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.136.20
description:
[2025-01-28 22:43:21 +0100] info [webmaild] 37.236.136.20 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 22:43:33 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 22:43:35 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (ruled) [51.255.84.180]:37774: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.172.130.191
description:
Jan 28 22:43:17 ait sshd[3953362]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.172.130.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.186
description:
Jan 28 22:43:23 ait sshd[3953374]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.186
description:
Jan 28 22:43:23 ait sshd[3953374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.186


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.172.130.191
description:
Jan 28 22:44:00 ait sshd[3953587]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.172.130.191 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.172.130.191
description:
Jan 28 22:44:00 ait sshd[3953587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.172.130.191


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.158.109.116
description:
[2025-01-28 22:44:26 +0100] info [webmaild] 189.158.109.116 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.19
description:
Jan 28 22:43:56 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.19
description:
2025-01-28 22:43:58 dovecot_plain authenticator failed for ([127.0.0.1]) [141.98.11.19]:59435: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.220.34
description:
[2025-01-28 22:46:38 +0100] info [webmaild] 131.221.220.34 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.199.162
description:
[2025-01-28 22:46:04 +0100] info [webmaild] 170.233.199.162 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 28 22:47:02 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 22:47:13 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
description:
Jan 28 22:47:19 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.163.158.36
description:
[2025-01-28 22:46:43 +0100] info [webmaild] 105.163.158.36 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.145.14.86
description:
[2025-01-28 22:46:45 +0100] info [webmaild] 177.145.14.86 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-28 22:47:04 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:49186: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 22:47:15 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (untroading) [51.255.84.180]:34918: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.91.63.141
description:
Jan 28 22:47:16 ait sshd[3954968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.91.63.141  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
description:
2025-01-28 22:47:21 dovecot_plain authenticator failed for ([211.53.58.10]) [211.53.58.10]:59994: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.74.241
description:
[2025-01-28 22:48:18 +0100] info [webmaild] 179.0.74.241 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.138.244
description:
Jan 28 22:49:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.138.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
description:
2025-01-28 22:49:27 dovecot_plain authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:39574: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 22:49:01 ait sshd[3955621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 22:49:17 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:59908: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 22:49:01 ait sshd[3955621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 28 22:49:15 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.76.102
description:
[2025-01-28 22:49:46 +0100] info [webmaild] 177.221.76.102 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.36.253.118
description:
[2025-01-28 22:50:10 +0100] info [webmaild] 197.36.253.118 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.21.42.24
description:
[2025-01-28 22:51:12 +0100] info [webmaild] 187.21.42.24 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.55.49
description:
[2025-01-28 22:51:35 +0100] info [webmaild] 170.245.55.49 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 22:51:00 ait sshd[3956607]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 22:51:00 ait sshd[3956607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 22:52:04 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 22:52:06 dovecot_plain authenticator failed for (anclan) [65.20.183.209]:44770: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-53.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.231.212.78
description:
2025-01-28 22:53:05 dovecot_plain authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:52411: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-28 22:53:27 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:36796: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 28 22:53:34 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-28 22:53:36 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:35250: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 28 22:52:50 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-28 22:52:52 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (insemi) [54.38.80.107]:46622: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.231.212.78
description:
Jan 28 22:53:03 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.231.212.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 28 22:53:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.35.73.87
description:
[2025-01-28 22:53:56 +0100] info [webmaild] 190.35.73.87 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.37.79.117
description:
2025-01-28 22:54:17 dovecot_plain authenticator failed for (dsl-104-37-79-117.dellcity.com) [104.37.79.117]:36505: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
description:
Jan 28 22:54:35 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 22:54:32 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.210
description:
Jan 28 22:53:47 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.210
description:
2025-01-28 22:53:49 dovecot_plain authenticator failed for ([61.169.54.210]) [61.169.54.210]:38326: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.79.117
description:
Jan 28 22:54:15 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.79.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-01-28 22:54:26 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:52728: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 22:54:34 dovecot_plain authenticator failed for (mipacke) [109.166.70.166]:35456: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
description:
2025-01-28 22:54:37 dovecot_plain authenticator failed for (nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:58820: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Jan 28 22:54:24 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 22:55:06 ait sshd[3958064]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 28 22:55:37 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-28 22:55:39 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:60386: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.113.122.222
description:
[2025-01-28 22:54:46 +0100] info [webmaild] 181.113.122.222 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 28 22:54:49 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.168.227.31
description:
[2025-01-28 22:55:00 +0100] info [webmaild] 152.168.227.31 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-28 22:54:51 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:37968: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 22:55:06 ait sshd[3958064]: Invalid user cinemalifestudio.com 2a03 from 122.51.104.242 port 46390


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 22:55:06 ait sshd[3958064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 22:55:50 ait sshd[3958302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 22:55:42 ait sshd[3958245]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.99.44.86
description:
Jan 28 22:56:15 ait sshd[3958613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.99.44.86


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 22:55:50 ait sshd[3958302]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.221.22
description:
[2025-01-28 22:56:08 +0100] info [webmaild] 176.29.221.22 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.99.44.86
description:
Jan 28 22:56:15 ait sshd[3958613]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.99.44.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.40.34
description:
[2025-01-28 22:56:14 +0100] info [webmaild] 191.99.40.34 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 22:55:42 ait sshd[3958245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.158
description:
Jan 28 22:55:46 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.158
description:
2025-01-28 22:55:48 dovecot_plain authenticator failed for ([217.22.37.158]) [217.22.37.158]:42005: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 22:55:50 ait sshd[3958302]: Invalid user cinemalifestudio.com 2a03 from 122.51.104.242 port 34496


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.183.37
description:
[2025-01-28 22:56:31 +0100] info [webmaild] 143.137.183.37 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
description:
2025-01-28 22:57:24 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:37487: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.1.213
description:
[2025-01-28 22:57:36 +0100] info [webmaild] 169.224.1.213 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 28 22:57:02 ait sshd[3958921]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 28 22:57:02 ait sshd[3958921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
description:
Jan 28 22:57:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
description:
2025-01-28 22:57:14 dovecot_plain authenticator failed for ([125.35.109.214]) [125.35.109.214]:46441: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
description:
Jan 28 22:57:22 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 22:57:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.84.176.120
description:
[2025-01-28 22:58:29 +0100] info [webmaild] 189.84.176.120 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.63.114
description:
47.128.63.114 - - [28/Jan/2025:22:58:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14646581 HTTP/2.0" 302 0 elibrary.ait-edu.us "https://elibrary.ait-edu.us/ebook/principles-of-financial-accounting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.63.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.236.193.74
description:
[2025-01-28 22:57:48 +0100] info [webmaild] 200.236.193.74 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.174.230.148
description:
[2025-01-28 22:58:16 +0100] info [webmaild] 181.174.230.148 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 22:58:29 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-01-28 22:59:27 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:63804: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Jan 28 22:59:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.108.76.182
description:
[2025-01-28 22:59:42 +0100] info [webmaild] 191.108.76.182 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-01-28 22:59:44 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:36817: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 28 23:00:24 ait sshd[3960359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 23:00:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (obing) [87.103.126.54]:21713: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Jan 28 22:59:42 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 22:59:53 ait sshd[3959923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 22:59:53 ait sshd[3959923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 28 23:00:24 ait sshd[3960359]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 23:00:32 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 23:00:33 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.162
description:
Jan 28 23:01:02 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 28 23:01:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.32.219
description:
[2025-01-28 23:01:38 +0100] info [webmaild] 191.5.32.219 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-28 23:01:27 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (prostelly) [94.45.76.149]:38803: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.211.66
description:
[2025-01-28 23:00:41 +0100] info [webmaild] 177.55.211.66 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.138.162
description:
2025-01-28 23:01:04 dovecot_plain authenticator failed for (201-63-138-162.customer.tdatabrasil.net.br) [201.63.138.162]:33556: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-28 23:01:14 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:52536: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 23:01:17 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 28 23:01:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Jan 28 23:01:45 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 23:02:14 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-28 23:01:47 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:33184: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 28 23:02:08 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-28 23:02:10 dovecot_plain authenticator failed for ([213.57.214.111]) [213.57.214.111]:51069: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.111.166
description:
[2025-01-28 23:02:40 +0100] info [webmaild] 131.196.111.166 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS20A00143Y||WPU:ADS20A00143Y||RSV:6.65||T:APACHE||MV:23-03.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-28 23:03:27 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:51788: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.30.234.153
description:
Jan 28 23:03:33 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.30.234.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.234.153
description:
2025-01-28 23:03:35 dovecot_plain authenticator failed for s153-234-30-96.ssvec.az.wi-power.com [96.30.234.153]:40698: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.132.181.203
description:
[2025-01-28 23:03:06 +0100] info [webmaild] 103.132.181.203 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 28 23:03:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-28 23:04:16 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:53562: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.104
description:
Jan 28 23:04:26 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.104 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 28 23:04:32 ait sshd[3962087]: Invalid user universitypublishing from 116.122.157.193 port 33918


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 23:04:33 ait sshd[3962087]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 23:04:33 ait sshd[3962087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.208.240
description:
Jan 28 23:03:54 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.208.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.208.240
description:
2025-01-28 23:03:56 dovecot_plain authenticator failed for ([175.156.208.240]) [175.156.208.240]:49610: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 28 23:04:14 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 28 23:04:21 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-28 23:04:23 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:8041: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
description:
2025-01-28 23:04:28 dovecot_plain authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:46555: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.75.172.163
description:
2025-01-28 23:04:48 dovecot_login authenticator failed for ([220.75.172.163]) [220.75.172.163]:51390: 535 Incorrect authentication data (set_id=admissions)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.254
description:
2025-01-28 23:05:14 dovecot_plain authenticator failed for (nsg-corporate-254.230.187.122.airtel.in) [122.187.230.254]:46414: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.145.188.130
description:
Jan 28 23:05:18 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.145.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.145.188.130
description:
2025-01-28 23:05:20 dovecot_plain authenticator failed for ([119.145.188.130]) [119.145.188.130]:49429: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
description:
2025-01-28 23:05:28 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:39897: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.78.8
description:
[2025-01-28 23:05:34 +0100] info [webmaild] 186.224.78.8 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
description:
Jan 28 23:05:35 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.75.172.163
description:
Jan 28 23:04:46 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.75.172.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.254
description:
Jan 28 23:05:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
description:
Jan 28 23:05:26 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-01-28 23:05:37 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:49735: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.237.26
description:
[2025-01-28 23:05:58 +0100] info [webmaild] 186.225.237.26 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.109.185.67
description:
[2025-01-28 23:06:32 +0100] info [webmaild] 176.109.185.67 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.104.221.252
description:
Jan 28 23:07:20 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.104.221.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.221.252
description:
2025-01-28 23:07:22 dovecot_plain authenticator failed for ([210.104.221.252]) [210.104.221.252]:51174: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.184.240
description:
[2025-01-28 23:07:36 +0100] info [webmaild] 45.175.184.240 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.101.40.154
description:
[2025-01-28 23:07:36 +0100] info [webmaild] 191.101.40.154 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Jan 28 23:07:39 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 23:08:02 ait sshd[3963817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=ftp


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
description:
Jan 28 23:08:05 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.149.186.33
description:
[2025-01-28 23:08:05 +0100] info [webmaild] 91.149.186.33 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 23:08:23 ait sshd[3963940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 28 23:08:29 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 23:08:23 ait sshd[3963940]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-28 23:08:31 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:34894: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-01-28 23:07:41 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:52105: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-28 23:07:48 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:22498: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 23:08:02 ait sshd[3963817]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
description:
2025-01-28 23:08:07 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:28862: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Jan 28 23:07:46 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-28 23:09:20 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:48680: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
description:
2025-01-28 23:09:33 dovecot_plain authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:63163: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Jan 28 23:08:47 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
description:
Jan 28 23:08:56 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 28 23:09:18 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-28 23:09:23 dovecot_plain authenticator failed for (limist) [185.65.238.250]:60560: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.164.166
description:
[2025-01-28 23:09:13 +0100] info [webmaild] 131.72.164.166 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.249.81
description:
[2025-01-28 23:09:17 +0100] info [webmaild] 170.246.249.81 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
description:
Jan 28 23:09:31 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 28 23:09:21 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:UG24J1150055||WPU:UG24J1150055||RSV:6.65||T:APACHE||MV:23-09.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
description:
Jan 28 23:08:47 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
description:
2025-01-28 23:08:49 dovecot_plain authenticator failed for (ANO-SH-21.Moscow.access.comstar.ru) [83.237.42.54]:38916: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-01-28 23:08:49 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:33776: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
description:
2025-01-28 23:08:58 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:42931: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Jan 28 23:10:00 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Jan 28 23:10:13 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.193.147
description:
Jan 28 23:09:43 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.193.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 28 23:09:49 ait sshd[3964470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.64.163
description:
2025-01-28 23:10:14 dovecot_plain authenticator failed for ([222.88.64.163]) [222.88.64.163]:41351: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-01-28 23:10:15 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:50974: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 28 23:09:49 ait sshd[3964470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 28 23:09:53 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-01-28 23:10:02 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:45542: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.120.248.0
description:
[2025-01-28 23:10:04 +0100] info [webmaild] 190.120.248.0 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.209.193.147
description:
2025-01-28 23:09:45 dovecot_plain authenticator failed for ([186.209.193.147]) [186.209.193.147]:53258: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.88.64.163
description:
Jan 28 23:10:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.88.64.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.10.129.6
description:
[2025-01-28 23:09:52 +0100] info [webmaild] 41.10.129.6 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-28 23:09:55 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:51913: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-01-28 23:11:15 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:40322: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
description:
Jan 28 23:10:49 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
description:
2025-01-28 23:10:51 dovecot_plain authenticator failed for ([202.177.247.242]) [202.177.247.242]:47406: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.208.152
description:
[2025-01-28 23:10:54 +0100] info [webmaild] 45.65.208.152 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 28 23:10:59 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-28 23:11:01 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:32888: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Jan 28 23:11:13 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.54.161.51
description:
[2025-01-28 23:11:17 +0100] info [webmaild] 191.54.161.51 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.149.46
description:
Jan 28 23:13:15 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.149.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.149.46
description:
2025-01-28 23:13:17 dovecot_plain authenticator failed for (coendy) [109.166.149.46]:39864: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 28 23:13:27 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-28 23:13:29 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:37928: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.13.251
description:
[2025-01-28 23:12:48 +0100] info [webmaild] 179.108.13.251 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.153.169
description:
Jan 28 23:14:04 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.153.169 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.203.201.40
description:
[2025-01-28 23:14:28 +0100] info [webmaild] 177.203.201.40 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.7.12.8
description:
[2025-01-28 23:14:13 +0100] info [webmaild] 45.7.12.8 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 28 23:14:24 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.121.66.215
description:
Jan 28 23:13:46 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.121.66.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.121.66.215
description:
2025-01-28 23:13:48 dovecot_plain authenticator failed for ([220.121.66.215]) [220.121.66.215]:59686: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 28 23:13:50 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 23:13:51 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-28 23:13:52 dovecot_plain authenticator failed for (unrad) [149.0.19.108]:48258: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.159.140
description:
Jan 28 23:15:29 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.159.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-28 23:14:59 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:50009: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
description:
2025-01-28 23:15:23 dovecot_plain authenticator failed for (shied) [65.20.147.45]:40602: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.78
description:
2025-01-28 23:15:27 dovecot_plain authenticator failed for (scart) [65.20.162.78]:48648: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-01-28 23:15:22 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:53732: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.78
description:
Jan 28 23:15:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.208.79
description:
Jan 28 23:15:28 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.208.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 23:15:09 ait sshd[3966758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.61.186
description:
47.128.61.186 - - [28/Jan/2025:23:15:19 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12250928 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/open/index.php?Itemid=321&id=267&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.61.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
description:
Jan 28 23:15:21 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.208.79
description:
2025-01-28 23:15:30 dovecot_plain authenticator failed for (223-197-208-79.static.imsbiz.com) [223.197.208.79]:51930: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.159.140
description:
2025-01-28 23:15:31 dovecot_plain authenticator failed for (abts-north-dynamic-140.159.176.122.airtelbroadband.in) [122.176.159.140]:36358: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 28 23:14:57 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 23:15:09 ait sshd[3966758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
description:
Jan 28 23:15:20 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.196.240.38
description:
Jan 28 23:14:59 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.196.240.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.196.240.38
description:
2025-01-28 23:15:01 dovecot_plain authenticator failed for ip72-196-240-38.dc.dc.cox.net (exual) [72.196.240.38]:54133: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.128.91
description:
2025-01-28 23:16:37 dovecot_login authenticator failed for p81092-obmd01.osaka.ocn.ne.jp [180.7.128.91]:49282: 535 Incorrect authentication data (set_id=idabiri14)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 23:16:05 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 28 23:16:14 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-28 23:16:16 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:58305: 535 Incorrect authentication data (set_id=idabiri14@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.128.91
description:
Jan 28 23:16:35 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.128.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.193.233
description:
[2025-01-28 23:16:35 +0100] info [webmaild] 168.228.193.233 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-01-28 23:17:03 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:53540: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
description:
Jan 28 23:17:22 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.149.130
description:
[2025-01-28 23:17:25 +0100] info [webmaild] 197.185.149.130 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 28 23:16:52 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-28 23:16:54 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:58088: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Jan 28 23:17:01 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.99.42.45
description:
[2025-01-28 23:18:03 +0100] info [webmaild] 46.99.42.45 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.70
description:
Jan 28 23:18:38 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 23:18:38 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.70
description:
2025-01-28 23:18:40 dovecot_login authenticator failed for ([106.246.89.70]) [106.246.89.70]:39080: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 28 23:18:50 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-28 23:18:52 dovecot_login authenticator failed for ([116.113.253.178]) [116.113.253.178]:60123: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.50.17.245
description:
[2025-01-28 23:19:28 +0100] info [webmaild] 201.50.17.245 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 23:19:30 ait sshd[3968519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 23:19:30 ait sshd[3968519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 23:18:57 ait sshd[3968283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 23:18:57 ait sshd[3968283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.178.98.74
description:
[2025-01-28 23:19:13 +0100] info [webmaild] 191.178.98.74 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-01-28 23:20:12 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:57770: 535 Incorrect authentication data (set_id=osngsua@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 28 23:20:19 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.132.27
description:
Jan 28 23:20:35 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.132.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 23:20:07 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Jan 28 23:20:10 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.132.27
description:
2025-01-28 23:20:37 dovecot_login authenticator failed for ([103.218.132.27]) [103.218.132.27]:49626: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.224.65
description:
[2025-01-28 23:19:43 +0100] info [webmaild] 181.94.224.65 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:abs18a00049y||WPU:abs18a00049y||RSV:6.65||T:APACHE||MV:23-20.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-28 23:20:21 dovecot_login authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:37291: 535 Incorrect authentication data (set_id=osngsua)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
description:
2025-01-28 23:21:14 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:46881: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.171.150
description:
Jan 28 23:20:47 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.171.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.171.150
description:
2025-01-28 23:20:49 dovecot_login authenticator failed for ([221.0.171.150]) [221.0.171.150]:55239: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-28 23:20:55 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:55464: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
description:
Jan 28 23:21:01 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
description:
Jan 28 23:21:31 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.172.215
description:
[2025-01-28 23:20:46 +0100] info [webmaild] 177.22.172.215 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 28 23:20:53 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.118.249.184
description:
Jan 28 23:21:18 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.118.249.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.198.70
description:
[2025-01-28 23:21:26 +0100] info [webmaild] 177.12.198.70 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-28 23:21:13 dovecot_login authenticator failed for ([218.1.239.146]) [116.231.84.13]:41176: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.81
description:
Jan 28 23:21:22 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
description:
2025-01-28 23:21:24 dovecot_login authenticator failed for ([183.249.1.81]) [183.249.1.81]:52986: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.123.136.142
description:
[2025-01-28 23:21:28 +0100] info [webmaild] 186.123.136.142 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
description:
2025-01-28 23:21:03 dovecot_login authenticator failed for ([45.65.68.104]) [45.65.68.104]:50310: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 28 23:21:11 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.8.218.54
description:
Jan 28 23:21:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.8.218.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
description:
2025-01-28 23:21:33 dovecot_login authenticator failed for ([203.124.36.67]) [203.124.36.67]:48571: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.55.216
description:
[2025-01-28 23:20:53 +0100] info [webmaild] 170.239.55.216 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.249.184
description:
2025-01-28 23:21:20 dovecot_login authenticator failed for p174185-obmd01.osaka.ocn.ne.jp [61.118.249.184]:41564: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-01-28 23:22:02 dovecot_login authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:54018: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 28 23:22:07 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
description:
2025-01-28 23:22:06 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:40472: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.39.70
description:
[2025-01-28 23:21:42 +0100] info [webmaild] 45.173.39.70 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 23:21:50 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 23:21:52 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:61269: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-28 23:21:55 dovecot_login authenticator failed for ([220.182.11.126]) [220.182.11.126]:57398: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.195.104
description:
Jan 28 23:22:15 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-01-28 23:22:28 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:40986: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.122.152.159
description:
[2025-01-28 23:22:29 +0100] info [webmaild] 190.122.152.159 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-28 23:22:09 dovecot_login authenticator failed for ([212.120.163.110]) [212.120.163.110]:41322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 28 23:22:15 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-28 23:22:17 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:1423: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.157.32.129
description:
Jan 28 23:22:25 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.157.32.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.197.38
description:
Jan 28 23:21:49 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 28 23:21:53 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Jan 28 23:22:00 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Jan 28 23:22:05 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 28 23:22:35 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Jan 28 23:22:26 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.157.32.129
description:
2025-01-28 23:22:27 dovecot_login authenticator failed for ([41.157.32.129]) [41.157.32.129]:44820: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-28 23:22:37 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:47840: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.197.38
description:
2025-01-28 23:21:51 dovecot_login authenticator failed for ([117.211.197.38]) [117.211.197.38]:40920: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
description:
Jan 28 23:22:04 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-01-28 23:22:07 dovecot_login authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:56122: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.195.104
description:
2025-01-28 23:22:17 dovecot_login authenticator failed for ([103.187.195.104]) [103.187.195.104]:54226: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-28 23:23:38 dovecot_plain authenticator failed for (protherium) [65.20.143.159]:34657: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 23:23:32 ait sshd[3970132]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 23:23:32 ait sshd[3970132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 28 23:23:36 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 28 23:24:39 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.125.228.30
description:
[2025-01-28 23:24:22 +0100] info [webmaild] 200.125.228.30 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:10865365||WPU:10865365||RSV:6.65||T:APACHE||MV:23-24.170.205.31.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.164.176.146
description:
2025-01-28 23:24:57 dovecot_plain authenticator failed for ([123.164.176.146]) [123.164.176.146]:56566: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
description:
Jan 28 23:25:21 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-28 23:25:32 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:34930: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 23:24:40 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-28 23:24:41 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:53862: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.164.176.146
description:
Jan 28 23:24:55 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.164.176.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
description:
2025-01-28 23:25:23 dovecot_plain authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:49655: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 28 23:25:30 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.221.185.147
description:
[2025-01-28 23:25:57 +0100] info [webmaild] 156.221.185.147 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.41.213
description:
[2025-01-28 23:25:59 +0100] info [webmaild] 169.224.41.213 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
description:
Jan 28 23:26:06 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 23:26:27 +0100] info [cpaneld] 217.160.25.51 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
description:
2025-01-28 23:26:08 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:45856: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 23:27:31 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.194.161.23
description:
Jan 28 23:27:05 ait sshd[3971798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.194.161.23  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 28 23:27:32 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.24.86
description:
[2025-01-28 23:26:51 +0100] info [webmaild] 187.73.24.86 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.194.161.23
description:
Jan 28 23:27:05 ait sshd[3971798]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.194.161.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-28 23:27:34 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-196.tpgi.com.au) [110.175.220.250]:43844: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Jan 28 23:27:45 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-01-28 23:27:47 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:52093: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.184.139.110
description:
Jan 28 23:28:13 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.184.139.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.25.18
description:
Jan 28 23:28:00 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.25.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 23:27:43 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.194.161.23
description:
Jan 28 23:27:45 ait sshd[3972179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.194.161.23  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.194.161.23
description:
Jan 28 23:27:45 ait sshd[3972179]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.194.161.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-28 23:28:37 dovecot_login authenticator failed for ([58.42.226.215]) [58.42.226.215]:60581: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.25.18
description:
2025-01-28 23:28:02 dovecot_login authenticator failed for ([112.184.25.18]) [112.184.25.18]:33903: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.184.139.110
description:
2025-01-28 23:28:15 dovecot_login authenticator failed for ([222.184.139.110]) [222.184.139.110]:55053: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 28 23:28:35 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.223.59.165
description:
[2025-01-28 23:29:25 +0100] info [webmaild] 102.223.59.165 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.232.78
description:
Jan 28 23:28:55 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.232.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Jan 28 23:29:17 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-01-28 23:29:19 dovecot_login authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:54628: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.165.200
description:
Jan 28 23:29:34 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.165.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
description:
2025-01-28 23:29:36 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:60546: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.98.24.103
description:
[2025-01-28 23:28:49 +0100] info [webmaild] 186.98.24.103 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.232.78
description:
2025-01-28 23:28:57 dovecot_login authenticator failed for ([112.91.232.78]) [112.91.232.78]:53817: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.0.161.157
description:
[2025-01-28 23:30:27 +0100] info [webmaild] 167.0.161.157 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
description:
Jan 28 23:30:38 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-01-28 23:30:40 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:39920: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-29.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.174
description:
2025-01-28 23:31:02 dovecot_plain authenticator failed for ([218.149.228.174]) [218.149.228.174]:34178: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.215.241
description:
Jan 28 23:31:39 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.215.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.12.118.84
description:
[2025-01-28 23:31:14 +0100] info [webmaild] 189.12.118.84 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Jan 28 23:31:15 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
description:
2025-01-28 23:30:44 dovecot_plain authenticator failed for ([125.69.76.148]) [125.69.76.148]:34164: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.162.187.58
description:
[2025-01-28 23:30:50 +0100] info [webmaild] 189.162.187.58 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 28 23:30:53 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-28 23:30:55 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:60361: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-01-28 23:31:17 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:60504: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
description:
Jan 28 23:30:42 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.174
description:
Jan 28 23:31:00 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 28 23:31:26 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-28 23:31:28 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:19470: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.215.241
description:
2025-01-28 23:31:41 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:41188: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.164.246
description:
[2025-01-28 23:31:57 +0100] info [webmaild] 45.6.164.246 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
description:
2025-01-28 23:32:21 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:33620: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.216.101.84
description:
[2025-01-28 23:32:06 +0100] info [webmaild] 201.216.101.84 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:UG24J1150055||WPU:UG24J1150055||RSV:6.65||T:APACHE||MV:23-32.170.205.31.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.159.180.126
description:
[2025-01-28 23:32:16 +0100] info [webmaild] 201.159.180.126 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
description:
Jan 28 23:32:19 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.21.157
description:
[2025-01-28 23:33:00 +0100] info [webmaild] 177.185.21.157 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
description:
Jan 28 23:33:31 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.48.21
description:
[2025-01-28 23:32:47 +0100] info [webmaild] 45.4.48.21 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.118.125
description:
47.128.118.125 - - [28/Jan/2025:23:32:55 +0100] "GET /wp-content/plugins/elementor/assets/css/frontend-legacy.min.css HTTP/2.0" 200 1505 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13419281" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.118.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 23:33:04 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-01-28 23:33:33 dovecot_plain authenticator failed for ([60.221.224.220]) [60.221.224.220]:47342: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Jan 28 23:33:42 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-01-28 23:33:44 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:55386: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.236.201.27
description:
[2025-01-28 23:34:06 +0100] info [webmaild] 200.236.201.27 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-28 23:35:16 dovecot_plain authenticator failed for (hydria) [93.159.152.6]:49102: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.111
description:
Jan 28 23:35:23 ait sshd[3975449]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-28 23:35:33 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (ariveron) [83.233.242.245]:49028: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.4
description:
Jan 28 23:35:38 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
description:
2025-01-28 23:35:40 dovecot_plain authenticator failed for (hicher) [65.20.133.4]:39533: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.158.35
description:
Jan 28 23:34:51 ait sshd[3975140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.158.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 23:35:12 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 28 23:35:14 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 28 23:35:23 ait sshd[3975449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 28 23:35:30 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 28 23:35:31 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.158.35
description:
Jan 28 23:34:51 ait sshd[3975140]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.158.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-28 23:35:32 dovecot_plain authenticator failed for (pated) [94.140.210.134]:50477: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.55.63
description:
Jan 28 23:36:12 ait sshd[3976024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.55.63


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.55.63
description:
Jan 28 23:36:12 ait sshd[3976024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.55.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.128.6
description:
[2025-01-28 23:36:01 +0100] info [webmaild] 45.70.128.6 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
description:
2025-01-28 23:37:06 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:37188: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 23:36:50 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.124.31
description:
2025-01-28 23:37:16 dovecot_plain authenticator failed for ([163.179.124.31]) [163.179.124.31]:41845: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
description:
Jan 28 23:37:04 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.96.218.45
description:
[2025-01-28 23:37:24 +0100] info [webmaild] 179.96.218.45 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.124.31
description:
Jan 28 23:37:14 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.124.31 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.122.211.7
description:
[2025-01-28 23:37:25 +0100] info [webmaild] 41.122.211.7 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.212.118.117
description:
[2025-01-28 23:38:06 +0100] info [webmaild] 37.212.118.117 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-01-28 23:38:12 dovecot_login authenticator failed for ([5.31.30.115]) [5.31.30.115]:58375: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.34.106.146
description:
Jan 28 23:38:23 ait sshd[3976828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.34.106.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.34.106.146
description:
Jan 28 23:38:23 ait sshd[3976828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Jan 28 23:37:59 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-01-28 23:38:01 dovecot_login authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:55170: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
description:
Jan 28 23:38:18 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
description:
2025-01-28 23:38:20 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:38482: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Jan 28 23:38:33 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.56.214
description:
47.128.56.214 - - [28/Jan/2025:23:38:07 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8916306 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=256" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.56.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Jan 28 23:38:10 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-01-28 23:38:35 dovecot_plain authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:41215: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 23:38:47 ait sshd[3977031]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.62
description:
Jan 28 23:39:30 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.62
description:
2025-01-28 23:39:32 dovecot_plain authenticator failed for (sping) [65.20.193.62]:60669: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 23:38:47 ait sshd[3977031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 23:39:19 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.48.103
description:
Jan 28 23:39:56 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.48.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.75.104.218
description:
Jan 28 23:40:32 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.75.104.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 28 23:39:41 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-28 23:39:43 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:35787: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 23:40:24 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
description:
Jan 28 23:40:22 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.188.169
description:
2025-01-28 23:40:35 dovecot_login authenticator failed for ([180.7.188.169]) [180.7.188.169]:55506: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
description:
2025-01-28 23:39:44 dovecot_login authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:54871: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 23:40:10 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.34.106.146
description:
Jan 28 23:40:24 ait sshd[3977707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
description:
Jan 28 23:39:42 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.103.21
description:
[2025-01-28 23:40:18 +0100] info [webmaild] 138.185.103.21 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.104.218
description:
2025-01-28 23:40:34 dovecot_plain authenticator failed for ([91.75.104.218]) [91.75.104.218]:53721: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.158.35
description:
Jan 28 23:39:42 ait sshd[3977456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.158.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.48.103
description:
2025-01-28 23:39:58 dovecot_login authenticator failed for ([222.116.48.103]) [222.116.48.103]:45094: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Jan 28 23:40:10 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 23:40:21 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-01-28 23:40:12 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:32804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.34.106.146
description:
Jan 28 23:40:24 ait sshd[3977707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.34.106.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
description:
2025-01-28 23:40:24 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:47180: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.188.169
description:
Jan 28 23:40:33 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.188.169 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.158.35
description:
Jan 28 23:39:42 ait sshd[3977456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.158.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 23:41:26 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:57125: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.61.21
description:
Jan 28 23:40:59 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.61.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.61.21
description:
2025-01-28 23:41:01 dovecot_login authenticator failed for ([112.102.61.21]) [112.102.61.21]:37392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.158.35
description:
Jan 28 23:41:03 ait sshd[3978011]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.158.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 23:41:09 ait sshd[3978092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Jan 28 23:41:13 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Jan 28 23:40:46 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
description:
2025-01-28 23:40:47 dovecot_login authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:57670: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.79.153.245
description:
[2025-01-28 23:40:57 +0100] info [webmaild] 187.79.153.245 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.158.35
description:
Jan 28 23:41:03 ait sshd[3978011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.158.35


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.158.35
description:
Jan 28 23:41:05 ait sshd[3978011]: Failed password for invalid user steam from 152.32.158.35 port 46040 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.80.220.155
description:
Jan 28 23:41:15 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.80.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.80.220.155
description:
2025-01-28 23:41:17 dovecot_plain authenticator failed for mobile-107-80-220-155.mycingular.net [107.80.220.155]:52869: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 23:41:24 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-01-28 23:41:15 dovecot_login authenticator failed for ([116.132.43.94]) [116.132.43.94]:54214: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
description:
Jan 28 23:40:45 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-01-28 23:40:48 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:60284: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 23:41:09 ait sshd[3978092]: Invalid user cinemalifestudio.com 2a03 from 122.51.104.242 port 55758


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 23:41:09 ait sshd[3978092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20a00164y||WPU:ads20a00164y||RSV:6.65||T:APACHE||MV:23-42.170.205.31.106


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 23:42:21 ait sshd[3978448]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 28 23:42:24 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.34.106.146
description:
Jan 28 23:41:44 ait sshd[3978307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.34.106.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 23:42:21 ait sshd[3978448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.184.139.110
description:
2025-01-28 23:42:22 dovecot_plain authenticator failed for ([222.184.139.110]) [222.184.139.110]:33859: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 28 23:42:29 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 28 23:42:35 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-28 23:42:37 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:54351: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.184.139.110
description:
Jan 28 23:42:20 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.184.139.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-28 23:42:26 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:52754: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.174.40.114
description:
[2025-01-28 23:42:27 +0100] info [webmaild] 152.174.40.114 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 23:42:05 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.34.106.146
description:
Jan 28 23:41:44 ait sshd[3978307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.109.12.48
description:
[2025-01-28 23:41:49 +0100] info [webmaild] 105.109.12.48 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 23:41:59 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.92.107.201
description:
[2025-01-28 23:42:26 +0100] info [webmaild] 190.92.107.201 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-28 23:42:31 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:3877: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.251.60.75
description:
[2025-01-28 23:42:50 +0100] info [webmaild] 177.251.60.75 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
description:
Jan 28 23:43:45 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
description:
2025-01-28 23:43:47 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:35678: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.113
description:
Jan 28 23:43:59 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
description:
2025-01-28 23:44:01 dovecot_plain authenticator failed for ([130.185.96.113]) [130.185.96.113]:55004: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.242.204.22
description:
Jan 28 23:44:04 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.242.204.22 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:543509713||WPU:543509713||RSV:6.65||T:APACHE||MV:23-44.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 23:43:45 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
description:
Jan 28 23:43:48 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
description:
2025-01-28 23:43:50 dovecot_plain authenticator failed for ([92.62.243.174]) [92.62.243.174]:48081: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.242.204.22
description:
2025-01-28 23:44:06 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:3575: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
description:
Jan 28 23:45:44 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
description:
2025-01-28 23:45:46 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:49641: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Jan 28 23:46:57 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-01-28 23:47:34 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:34192: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Jan 28 23:46:56 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-01-28 23:46:59 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:54042: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 28 23:47:10 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 28 23:47:27 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 28 23:47:30 ait sshd[3980285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Jan 28 23:47:32 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
description:
Jan 28 23:47:08 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
description:
2025-01-28 23:47:10 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:38346: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-28 23:47:29 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (porne) [94.45.76.149]:52152: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-01-28 23:46:58 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:60893: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-28 23:47:12 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:53794: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 28 23:47:30 ait sshd[3980285]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-28 23:47:44 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (mylenes) [2.139.88.148]:57178: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-28 23:47:46 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:51970: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:23-48.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 28 23:47:42 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 28 23:47:44 ait auth[3943654]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 23:48:42 ait sshd[3980692]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 23:48:42 ait sshd[3980692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 23:49:48 ait sshd[3981012]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 23:49:48 ait sshd[3981012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Jan 28 23:50:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-28 23:50:17 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:53886: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.202
description:
Jan 28 23:51:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.202
description:
2025-01-28 23:51:32 dovecot_login authenticator failed for ([103.146.233.202]) [103.146.233.202]:40342: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-01-28 23:51:30 dovecot_login authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:46620: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 23:51:18 ait sshd[3981806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
description:
Jan 28 23:51:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 28 23:51:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-28 23:51:40 dovecot_login authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:53646: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 23:51:18 ait sshd[3981806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.126.75.206
description:
2025-01-28 23:51:29 dovecot_login authenticator failed for chil-pppoe-74-126-75-206.dsl.bright.net [74.126.75.206]:36801: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-28 23:50:46 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:51379: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.173.173.60
description:
Jan 28 23:51:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.173.173.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.173.173.60
description:
2025-01-28 23:51:17 dovecot_plain authenticator failed for (istrogeny) [178.173.173.60]:52996: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.126.75.206
description:
Jan 28 23:51:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.126.75.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 23:51:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 28 23:50:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.228.234
description:
Jan 28 23:51:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.228.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-28 23:51:57 dovecot_login authenticator failed for ([200.165.163.121]) [200.165.148.166]:58508: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 28 23:52:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 28 23:52:12 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.254.93.70
description:
2025-01-28 23:51:51 dovecot_login authenticator failed for ([61.254.93.70]) [61.254.93.70]:56732: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
description:
Jan 28 23:51:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Jan 28 23:51:54 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Jan 28 23:51:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-01-28 23:52:04 dovecot_login authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:18486: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.254.93.70
description:
Jan 28 23:51:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.254.93.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Jan 28 23:51:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-01-28 23:51:55 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:48839: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-01-28 23:51:56 dovecot_login authenticator failed for ([118.183.180.108]) [118.183.180.108]:25760: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-28 23:52:10 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:56510: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-28 23:52:14 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:57496: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.145.188.130
description:
Jan 28 23:51:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.145.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.228.234
description:
2025-01-28 23:51:43 dovecot_login authenticator failed for (234.228.185.190.cable.dyn.ridsa.com.ar) [190.185.228.234]:34213: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.145.188.130
description:
2025-01-28 23:51:44 dovecot_login authenticator failed for ([119.145.188.130]) [119.145.188.130]:37920: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-01-28 23:51:57 dovecot_login authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:42790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Jan 28 23:52:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 28 23:52:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-28 23:52:42 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (oceoute) [89.153.62.100]:42624: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 23:54:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 23:54:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-01-28 23:55:07 dovecot_plain authenticator failed for (prostee) [65.20.160.195]:39635: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 28 23:55:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Jan 28 23:55:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-28 23:55:10 dovecot_plain authenticator failed for (lavering) [149.0.19.108]:45586: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 28 23:56:12 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 28 23:56:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-28 23:56:27 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:39832: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-28 23:56:14 dovecot_login authenticator failed for ([103.182.161.206]) [103.182.161.206]:59236: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 23:56:40 ait sshd[3983735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 23:56:40 ait sshd[3983735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 23:58:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 23:58:51 ait sshd[3984486]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 23:59:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 23:58:51 ait sshd[3984486]: Invalid user cinemalifestudio.com 2a03 from 122.51.104.242 port 40576


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 23:58:51 ait sshd[3984486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-01-29 00:00:35 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:56863: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-01-28 23:59:54 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:52338: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.158
description:
Jan 29 00:00:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.158
description:
2025-01-29 00:00:18 dovecot_plain authenticator failed for ([217.22.37.158]) [217.22.37.158]:33163: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Jan 29 00:00:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-29 00:00:14 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:45800: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 28 23:59:47 ait sshd[3984634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=lemsas


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
description:
Jan 28 23:59:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 00:00:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 29 00:00:12 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 28 23:59:47 ait sshd[3984634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Jan 29 00:01:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-01-29 00:01:06 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39894: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Jan 29 00:01:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-01-29 00:01:27 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:54558: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 00:01:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Jan 29 00:01:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-29 00:01:18 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:45748: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Jan 29 00:02:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Jan 29 00:02:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 29 00:02:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-29 00:02:39 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:61708: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Jan 29 00:02:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-01-29 00:02:27 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:60409: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Jan 29 00:02:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.185.108
description:
Jan 29 00:01:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.185.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-01-29 00:02:33 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:57033: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-29 00:02:38 dovecot_plain authenticator failed for ([61.169.31.242]) [61.169.31.242]:55486: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.185.108
description:
2025-01-29 00:01:42 dovecot_plain authenticator failed for ([120.197.185.108]) [120.197.185.108]:41768: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-01-29 00:02:21 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:51134: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 29 00:02:37 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-01-29 00:02:42 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:51923: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-29 00:03:04 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:33116: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.55.63
description:
Jan 29 00:03:19 ait sshd[3986190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.55.63


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
description:
Jan 29 00:02:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
description:
2025-01-29 00:02:54 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:41606: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-29 00:03:06 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:9715: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.55.63
description:
Jan 29 00:03:19 ait sshd[3986190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.55.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 29 00:03:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-29 00:03:31 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:52804: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
description:
Jan 29 00:03:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 29 00:03:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Jan 29 00:03:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-01-29 00:03:21 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:37619: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.33.44.12
description:
Jan 29 00:03:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.33.44.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 29 00:03:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 29 00:03:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-01-29 00:04:19 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:51720: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 29 00:04:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.33.44.12
description:
2025-01-29 00:03:42 dovecot_plain authenticator failed for ([209.33.44.12]) [209.33.44.12]:56280: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.248.232.70
description:
Jan 29 00:03:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.248.232.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.248.232.70
description:
2025-01-29 00:03:51 dovecot_plain authenticator failed for (static-89-248-232-70.tel.ru) [89.248.232.70]:42028: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-29 00:04:31 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:28418: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 00:03:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
description:
Jan 29 00:04:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.55.63
description:
Jan 29 00:04:45 ait sshd[3986579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.55.63


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 00:05:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.190
description:
Jan 29 00:05:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.55.63
description:
Jan 29 00:04:45 ait sshd[3986579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.55.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.55.63
description:
Jan 29 00:06:09 ait sshd[3987599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.55.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
description:
Jan 29 00:05:59 ait sshd[3987401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
description:
Jan 29 00:06:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-01-29 00:06:36 dovecot_plain authenticator failed for ([60.221.224.220]) [60.221.224.220]:54993: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-29 00:05:58 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (mograt) [85.69.178.104]:56054: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
description:
Jan 29 00:05:59 ait sshd[3987401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.55.63
description:
Jan 29 00:06:09 ait sshd[3987599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.55.63


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.126.55.63
description:
Jan 29 00:06:10 ait sshd[3987599]: Failed password for invalid user alex from 101.126.55.63 port 46342 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.190
description:
2025-01-29 00:05:42 dovecot_plain authenticator failed for (apancess) [2.110.10.190]:57882: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 29 00:05:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.173.82.198
description:
Jan 29 00:06:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.173.82.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-01-29 00:07:07 dovecot_login authenticator failed for ([95.164.176.167]) [95.164.176.167]:48934: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 29 00:07:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
description:
Jan 29 00:06:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
description:
2025-01-29 00:06:51 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:54833: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.107.10.172
description:
Jan 29 00:07:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.107.10.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.82.198
description:
2025-01-29 00:06:51 dovecot_login authenticator failed for ([222.173.82.198]) [222.173.82.198]:6348: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-01-29 00:06:53 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:34884: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-01-29 00:06:54 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:44841: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.107.10.172
description:
2025-01-29 00:07:07 dovecot_login authenticator failed for (mail.frontop.cn) [218.107.10.172]:52588: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 00:07:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-06.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
description:
Jan 29 00:06:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Jan 29 00:06:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Jan 29 00:07:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-29 00:07:19 dovecot_login authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:53514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 29 00:08:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 00:08:40 ait sshd[3988537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 00:08:40 ait sshd[3988537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Jan 29 00:08:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-01-29 00:08:46 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:50049: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 00:08:54 ait sshd[3988577]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 00:08:54 ait sshd[3988577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
description:
Jan 29 00:09:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.229.233.219
description:
Jan 29 00:08:42 ait sshd[3988537]: Failed password for invalid user microway from 156.229.233.219 port 24612 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
description:
2025-01-29 00:09:13 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:58359: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 29 00:11:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-29 00:11:36 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:39688: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Jan 29 00:11:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-01-29 00:11:25 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:40563: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 29 00:12:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-29 00:12:24 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:43906: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 29 00:12:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-29 00:12:15 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:37817: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.192.69.9
description:
Jan 29 00:13:01 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.192.69.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.192.69.9
description:
2025-01-29 00:13:03 dovecot_plain authenticator failed for ([113.192.69.9]) [113.192.69.9]:39660: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.199.165
description:
Jan 29 00:13:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-01-29 00:13:15 dovecot_plain authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:58034: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.255.80
description:
2025-01-29 00:12:53 dovecot_plain authenticator failed for p99080-obmd01.tokyo.ocn.ne.jp [124.101.255.80]:50385: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.236.170.3
description:
2025-01-29 00:14:37 dovecot_plain authenticator failed for ([4.236.170.3]) [4.236.170.3]:51855: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 00:14:27 ait sshd[3990756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.236.170.3
description:
Jan 29 00:14:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.236.170.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 00:14:27 ait sshd[3990756]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.167.114.221
description:
Jan 29 00:15:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.167.114.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
description:
Jan 29 00:15:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-01-29 00:15:32 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:60250: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.194.43.140
description:
Jan 29 00:14:58 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.194.43.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.194.43.140
description:
2025-01-29 00:15:00 dovecot_plain authenticator failed for st0652.mas4401.y-tokyo.nttpc.ne.jp [61.194.43.140]:35046: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 29 00:15:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-29 00:15:04 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:44333: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 29 00:15:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.82
description:
Jan 29 00:14:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-29 00:15:08 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (spelingon) [176.37.212.85]:38289: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
description:
2025-01-29 00:15:15 dovecot_plain authenticator failed for ([180.104.103.146]) [180.104.103.146]:45749: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Jan 29 00:15:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-29 00:16:13 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:43466: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Jan 29 00:16:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-01-29 00:16:21 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:60444: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.67
description:
Jan 29 00:16:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Jan 29 00:15:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-01-29 00:15:50 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:33055: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 29 00:16:01 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-29 00:16:03 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:46724: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 29 00:16:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.67
description:
2025-01-29 00:16:24 dovecot_plain authenticator failed for ([106.246.89.67]) [106.246.89.67]:41206: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.193.41.66
description:
Jan 29 00:17:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.193.41.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.193.41.66
description:
2025-01-29 00:17:31 dovecot_plain authenticator failed for ([141.193.41.66]) [141.193.41.66]:58176: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.245
description:
2025-01-29 00:16:47 dovecot_plain authenticator failed for ([221.149.233.245]) [221.149.233.245]:42163: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.86.87
description:
2025-01-29 00:17:17 dovecot_plain authenticator failed for c-73-199-86-87.hsd1.nj.comcast.net (rebeanted) [73.199.86.87]:47616: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
description:
Jan 29 00:17:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
description:
2025-01-29 00:17:24 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:40512: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.16.150.212
description:
Jan 29 00:17:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.16.150.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.16.150.212
description:
2025-01-29 00:17:38 dovecot_plain authenticator failed for ([219.140.170.34]) [27.16.150.212]:59970: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.245
description:
Jan 29 00:16:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 29 00:16:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-29 00:16:57 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:27328: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
description:
2025-01-29 00:17:13 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:45000: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
description:
Jan 29 00:17:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.86.87
description:
Jan 29 00:17:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.86.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
description:
Jan 29 00:17:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
description:
2025-01-29 00:17:23 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:45873: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.69.242.122
description:
2025-01-29 00:17:44 dovecot_plain authenticator failed for ([101.69.242.122]) [101.69.242.122]:35731: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 29 00:18:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-29 00:18:27 dovecot_plain authenticator failed for (lammous) [77.239.255.163]:57828: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.69.242.122
description:
Jan 29 00:17:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.69.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Jan 29 00:19:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-01-29 00:19:36 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:53902: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 00:19:37 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 29 00:20:03 ait sshd[3992829]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 29 00:20:03 ait sshd[3992829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Jan 29 00:20:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-29 00:20:36 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:47476: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 29 00:19:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-29 00:19:52 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:47282: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.137.248
description:
Jan 29 00:20:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.137.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.137.248
description:
2025-01-29 00:20:47 dovecot_plain authenticator failed for ([60.191.137.248]) [60.191.137.248]:43392: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 204.10.194.167
domain: iric.us
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:titlemas||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 00:23:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 00:23:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.111
description:
Jan 29 00:24:23 ait sshd[3994795]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 29 00:24:23 ait sshd[3994795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
description:
Jan 29 00:25:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
description:
2025-01-29 00:25:31 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:49650: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
description:
Jan 29 00:25:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
description:
2025-01-29 00:25:36 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:45060: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 29 00:25:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-29 00:25:21 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:51408: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
description:
Jan 29 00:25:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
description:
2025-01-29 00:25:54 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:39720: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 00:25:58 ait sshd[3995502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.240.37.74
description:
2025-01-29 00:26:07 dovecot_plain authenticator failed for ([1.71.191.42]) [61.240.37.74]:47092: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 00:25:58 ait sshd[3995502]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.240.37.74
description:
Jan 29 00:26:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.240.37.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.111.139.88
description:
Jan 29 00:26:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.111.139.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.111.139.88
description:
2025-01-29 00:26:18 dovecot_plain authenticator failed for pool-98-111-139-88.phlapa.fios.verizon.net [98.111.139.88]:37687: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
description:
2025-01-29 00:27:18 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:33080: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-29 00:27:35 dovecot_plain authenticator failed for (bughted) [102.53.15.56]:54847: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
description:
Jan 29 00:27:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Jan 29 00:27:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 00:27:36 ait sshd[3996575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 00:27:36 ait sshd[3996575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 29 00:27:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-01-29 00:27:33 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:43554: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Jan 29 00:27:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 00:27:54 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-01-29 00:27:53 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:44536: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
description:
Jan 29 00:28:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-01-29 00:28:16 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:51938: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 29 00:28:55 ait sshd[3996840]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 29 00:28:55 ait sshd[3996840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
description:
Jan 29 00:29:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
description:
2025-01-29 00:29:49 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:38604: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.114.217.63
description:
Jan 29 00:29:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.114.217.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 29 00:29:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.114.217.63
description:
2025-01-29 00:29:55 dovecot_plain authenticator failed for c-213-114-217-63.bbcust.telenor.se (brape) [213.114.217.63]:43376: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-29 00:29:57 dovecot_plain authenticator failed for ([188.226.47.211]) [188.226.47.211]:54570: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.33.197
description:
Jan 29 00:31:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.33.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.209.221.7
description:
Jan 29 00:30:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.209.221.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
description:
Jan 29 00:32:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 00:32:38 ait sshd[3998304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 00:32:38 ait sshd[3998304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-01-29 00:32:40 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:47695: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Jan 29 00:32:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
description:
2025-01-29 00:32:26 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:43955: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.106
description:
[2025-01-29 00:33:23 +0100] info [whostmgrd] 104.207.59.106 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.78
description:
[2025-01-29 00:33:22 +0100] info [cpaneld] 104.207.35.78 - ads20a00079y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00079y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.83
description:
[2025-01-29 00:33:20 +0100] info [cpaneld] 104.207.45.83 - ads20a00079y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00079y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.199
description:
[2025-01-29 00:33:22 +0100] info [cpaneld] 156.228.119.199 - ads20a00079y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00079y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.117
description:
[2025-01-29 00:33:23 +0100] info [whostmgrd] 156.228.105.117 - ads20a00079y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Jan 29 00:33:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-01-29 00:33:18 dovecot_login authenticator failed for ([80.233.77.136]) [80.233.77.136]:3558: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.77.123
description:
[2025-01-29 00:33:27 +0100] info [whostmgrd] 156.228.77.123 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.108.8
description:
[2025-01-29 00:33:28 +0100] info [whostmgrd] 156.228.108.8 - ads20a00079y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.31
description:
[2025-01-29 00:33:28 +0100] info [whostmgrd] 156.228.118.31 - ads20a00079y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.164
description:
[2025-01-29 00:33:21 +0100] info [cpaneld] 104.207.48.164 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.184
description:
Jan 29 00:33:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.109
description:
[2025-01-29 00:33:21 +0100] info [cpaneld] 156.228.105.109 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.255
description:
[2025-01-29 00:33:27 +0100] info [whostmgrd] 104.207.40.255 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
description:
2025-01-29 00:33:30 dovecot_login authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:42764: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 00:34:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-01-29 00:35:06 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:49615: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
description:
Jan 29 00:34:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
description:
2025-01-29 00:34:44 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:56950: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.197.48
description:
Jan 29 00:34:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.197.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 29 00:35:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 00:34:42 ait sshd[3998943]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Jan 29 00:35:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-29 00:35:26 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:37703: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.197.48
description:
2025-01-29 00:34:57 dovecot_plain authenticator failed for (1rgptni7u9q29en985v7s) [197.255.197.48]:34244: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 00:34:42 ait sshd[3998943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=ftp


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Jan 29 00:36:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-01-29 00:36:15 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:51581: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Jan 29 00:35:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-01-29 00:35:47 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:57776: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-01-29 00:36:04 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:20538: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
description:
Jan 29 00:36:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 00:37:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-01-29 00:37:46 dovecot_login authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:28227: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
description:
Jan 29 00:37:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
description:
2025-01-29 00:37:59 dovecot_login authenticator failed for ([1.252.63.242]) [1.252.63.242]:33656: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 00:37:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.199.165
description:
Jan 29 00:37:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Jan 29 00:39:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-29 00:39:23 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:53696: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-01-29 00:39:23 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:55248: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
description:
Jan 29 00:39:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 29 00:39:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-01-29 00:39:33 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:46568: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 00:39:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 00:40:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 29 00:39:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-29 00:39:48 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:52669: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-29 00:39:59 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:57678: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.225.143
description:
Jan 29 00:40:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.225.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.225.143
description:
2025-01-29 00:40:02 dovecot_plain authenticator failed for s143-225-68-64.ssvec.az.wi-power.com [64.68.225.143]:53042: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Jan 29 00:40:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-01-29 00:40:35 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (locrodery) [2.36.64.247]:37424: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 29 00:39:46 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.129.123
description:
Jan 29 00:41:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.129.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Jan 29 00:41:25 ait sshd[4001769]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 29 00:40:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-29 00:40:58 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:46526: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
description:
2025-01-29 00:41:11 dovecot_plain authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:54668: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 29 00:41:25 ait sshd[4001769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-29 00:42:27 dovecot_plain authenticator failed for ([103.250.160.76]) [117.198.165.140]:57729: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-01-29 00:42:37 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4037: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Jan 29 00:42:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 29 00:42:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
description:
Jan 29 00:42:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.105.66
description:
Jan 29 00:42:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.105.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.150.87.70
description:
2025-01-29 00:42:38 dovecot_plain authenticator failed for ([193.150.87.70]) [193.150.87.70]:37235: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-01-29 00:42:25 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:54944: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.150.87.70
description:
Jan 29 00:42:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.150.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Jan 29 00:43:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-01-29 00:43:13 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:60988: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Jan 29 00:43:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 00:43:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-43.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-01-29 00:43:26 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:28155: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-29 00:44:12 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (eutics) [85.69.178.104]:47462: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.72.143
description:
Jan 29 00:44:24 ait sshd[4003120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.72.143


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.115.178.66
description:
Jan 29 00:44:52 ait sshd[4003187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.115.178.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.115.178.66
description:
Jan 29 00:44:52 ait sshd[4003187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.115.178.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 29 00:44:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.72.143
description:
Jan 29 00:44:24 ait sshd[4003120]: pam_imunify(sshd:auth): [IM360_RBL] The IP 161.35.72.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 00:44:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-01-29 00:45:06 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:39035: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.150.87.70
description:
2025-01-29 00:45:35 dovecot_plain authenticator failed for ([193.150.87.70]) [193.150.87.70]:48383: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Jan 29 00:45:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Jan 29 00:45:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 29 00:45:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.115.178.66
description:
Jan 29 00:44:54 ait sshd[4003187]: Failed password for invalid user server from 181.115.178.66 port 42724 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-01-29 00:45:25 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:49962: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.150.87.70
description:
Jan 29 00:45:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.150.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-29 00:45:15 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:54936: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 00:46:04 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:41742: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 00:46:44 ait sshd[4004149]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.107
description:
Jan 29 00:46:11 ait sshd[4004089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 00:46:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
description:
Jan 29 00:46:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 00:46:44 ait sshd[4004149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-01-29 00:46:44 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:53511: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.34.229
description:
2025-01-29 00:47:07 dovecot_plain authenticator failed for ([124.152.34.229]) [124.152.34.229]:49451: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Jan 29 00:46:54 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-01-29 00:46:56 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:34845: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.34.229
description:
Jan 29 00:47:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.34.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Jan 29 00:49:12 ait sshd[4004880]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-01-29 00:49:44 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:41148: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
description:
Jan 29 00:49:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.115.178.66
description:
Jan 29 00:48:56 ait sshd[4004719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.115.178.66


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
description:
2025-01-29 00:49:06 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:57414: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Jan 29 00:49:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-01-29 00:49:17 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:35390: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.150.213.239
description:
Jan 29 00:49:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.150.213.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 29 00:49:12 ait sshd[4004880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.115.178.66
description:
Jan 29 00:48:56 ait sshd[4004719]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.115.178.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.213.239
description:
2025-01-29 00:49:32 dovecot_plain authenticator failed for ([103.150.213.239]) [103.150.213.239]:42916: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Jan 29 00:49:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.252.218
description:
Jan 29 00:50:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.252.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 00:50:52 ait sshd[4005580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 29 00:50:21 ait sshd[4005354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.115.178.66
description:
Jan 29 00:50:28 ait sshd[4005464]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.115.178.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.115.178.66
description:
Jan 29 00:50:28 ait sshd[4005464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.115.178.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 00:50:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.252.218
description:
2025-01-29 00:50:51 dovecot_plain authenticator failed for ([220.189.252.218]) [220.189.252.218]:42420: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.157.246.26
description:
2025-01-29 00:50:39 dovecot_plain authenticator failed for ([117.157.246.26]) [117.157.246.26]:33076: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.115.178.66
description:
Jan 29 00:50:30 ait sshd[4005464]: Failed password for invalid user steam from 181.115.178.66 port 34526 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.157.246.26
description:
Jan 29 00:50:37 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.157.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.107
description:
Jan 29 00:49:56 ait sshd[4005009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.107


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 29 00:50:21 ait sshd[4005354]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 00:50:52 ait sshd[4005580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.148.10.196
description:
Jan 29 00:50:54 ait sshd[4005580]: Failed password for invalid user aitedu from 45.148.10.196 port 54722 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.73.139
description:
2025-01-29 00:52:12 dovecot_plain authenticator failed for (139.73.34.171.adsl-pool.jx.chinaunicom.com) [171.34.73.139]:1039: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.73.139
description:
Jan 29 00:52:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.73.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.142
description:
Jan 29 00:51:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.142
description:
2025-01-29 00:51:58 dovecot_plain authenticator failed for ([116.124.241.142]) [116.124.241.142]:42602: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 116.202.132.101
domain: ait.university
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/phdxx/images/K.php||SC:/home/titlemas/public_html/ait.university/phdxx/images/K.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
description:
2025-01-29 00:53:46 dovecot_plain authenticator failed for (ctw.webcas.net) [125.69.76.148]:44406: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-29 00:53:34 dovecot_plain authenticator failed for ([211.105.223.49]) [211.105.223.49]:42526: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
description:
Jan 29 00:53:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 29 00:53:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 00:53:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-29 00:54:11 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:22111: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
description:
2025-01-29 00:54:31 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:50716: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-01-29 00:54:35 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:38706: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
description:
Jan 29 00:54:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
description:
2025-01-29 00:54:24 dovecot_plain authenticator failed for ([103.172.48.197]) [103.172.48.197]:37468: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 29 00:54:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
description:
Jan 29 00:54:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Jan 29 00:54:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 29 00:54:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Jan 29 00:53:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-29 00:54:42 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:44582: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-01-29 00:53:59 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:36610: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 29 00:55:32 ait sshd[4007334]: Invalid user universitypublishing from 116.122.157.193 port 36580


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 00:55:33 ait sshd[4007334]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 00:54:58 ait sshd[4006915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 00:55:33 ait sshd[4007334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 00:54:58 ait sshd[4006915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.107
description:
Jan 29 00:55:22 ait sshd[4007213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.107


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 00:55:47 ait sshd[4007378]: Invalid user createursdespoir.net 2600 from 111.231.56.128 port 43288


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 00:54:58 ait sshd[4006915]: Invalid user bellafiallos.com 2a02 from 122.51.104.242 port 56222


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 00:55:48 ait sshd[4007378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 00:55:48 ait sshd[4007378]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.212
description:
47.128.58.212 - - [29/Jan/2025:00:56:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12062983 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=183%2C99%2C79%2C121&filtering=1&instructor=1%2C2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 00:56:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 00:57:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-29 00:57:10 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:40580: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-01-29 00:57:21 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:49732: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.113.179.38
description:
Jan 29 00:57:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.113.179.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 29 00:57:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
description:
Jan 29 00:57:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-01-29 00:58:18 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:55592: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.96.133
description:
Jan 29 00:58:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.96.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-29 00:58:52 dovecot_plain authenticator failed for (sclarituos) [77.51.214.170]:36307: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.96.133
description:
2025-01-29 00:58:29 dovecot_plain authenticator failed for ([61.185.96.133]) [61.185.96.133]:53265: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Jan 29 00:58:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Jan 29 00:58:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-01-29 00:58:50 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:51568: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
description:
Jan 29 00:58:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
description:
Jan 29 00:58:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
description:
2025-01-29 00:58:15 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:37970: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 29 00:58:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
description:
2025-01-29 00:58:54 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:52289: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-29 00:58:55 dovecot_plain authenticator failed for (hommotien) [109.108.95.66]:44262: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 29 00:58:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.113.179.38
description:
Jan 29 00:57:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.113.179.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Jan 29 00:58:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-29 00:58:27 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:50194: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Jan 29 00:58:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 29 00:58:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-01-29 00:58:50 dovecot_plain authenticator failed for ([27.188.73.223]) [27.188.73.223]:43136: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
description:
Jan 29 00:58:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-01-29 00:58:34 dovecot_plain authenticator failed for ([201.18.75.41]) [201.18.71.134]:56488: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-01-29 00:58:45 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:42018: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 00:59:23 ait sshd[4008439]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 00:59:23 ait sshd[4008439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 00:59:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Jan 29 00:58:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-01-29 00:59:01 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:38790: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 01:02:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.99.128.102
description:
Jan 29 01:04:26 ait sshd[4010761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.99.128.102  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
description:
2025-01-29 01:05:09 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:35262: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 29 01:05:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-01-29 01:05:43 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:41741: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 01:05:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-29 01:05:00 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:34551: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.99.128.102
description:
Jan 29 01:05:05 ait sshd[4010964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.99.128.102  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
description:
Jan 29 01:05:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-29 01:05:27 dovecot_plain authenticator failed for ([115.85.251.188]) [115.85.251.188]:54050: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
description:
Jan 29 01:05:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 29 01:04:58 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 29 01:06:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-29 01:06:53 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:35580: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
description:
Jan 29 01:06:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
description:
2025-01-29 01:06:38 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:34994: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 01:07:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.160.25.51
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-07.217.160.25.51


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 01:09:25 ait sshd[4012451]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 01:09:25 ait sshd[4012451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 29 01:08:57 ait sshd[4012261]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 29 01:08:57 ait sshd[4012261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.209.252
description:
2025-01-29 01:10:10 dovecot_plain authenticator failed for 31-208-209-252.cust.bredband2.com [31.208.209.252]:43788: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 01:10:32 ait sshd[4012952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Jan 29 01:10:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-01-29 01:10:19 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:55250: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 01:10:32 ait sshd[4012952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.209.252
description:
Jan 29 01:10:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.209.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Jan 29 01:10:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 29 01:10:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-01-29 01:10:58 dovecot_plain authenticator failed for ([50.82.12.128]) [50.82.12.128]:55684: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 29 01:11:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20b00359y||WPU:ads20b00359y||RSV:6.65||T:APACHE||MV:01-11.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.225
description:
2025-01-29 01:11:05 dovecot_plain authenticator failed for 83-233-71-225.cust.bredband2.com [83.233.71.225]:39118: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 29 01:11:16 ait sshd[4013039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-29 01:10:59 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (coequanter) [81.16.170.117]:44224: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.225
description:
Jan 29 01:11:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 29 01:11:16 ait sshd[4013039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-29 01:11:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ferds) [87.103.126.54]:61356: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.73.75.82
description:
Jan 29 01:12:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.73.75.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Jan 29 01:12:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-01-29 01:12:23 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:58055: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 01:12:33 ait sshd[4013605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.73.75.82
description:
2025-01-29 01:12:05 dovecot_plain authenticator failed for ([212.73.75.82]) [212.73.75.82]:46436: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 01:12:33 ait sshd[4013605]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-29 01:13:32 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:52438: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.227
description:
2025-01-29 01:13:49 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.227]:40902: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.29.82
description:
47.128.29.82 - - [29/Jan/2025:01:13:17 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10450338 HTTP/1.1" 302 0 ijari.us "http://ijari.us/index.php?Itemid=210&__im-qBGZTxyX=14686861413835837871&id=189&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
description:
Jan 29 01:13:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.134.32.74
description:
Jan 29 01:13:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.134.32.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.134.32.74
description:
2025-01-29 01:13:37 dovecot_plain authenticator failed for ([222.134.32.74]) [222.134.32.74]:51782: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.227
description:
Jan 29 01:13:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
description:
2025-01-29 01:13:45 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:36687: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 29 01:13:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-29 01:13:58 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57384: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
description:
Jan 29 01:14:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
description:
2025-01-29 01:14:10 dovecot_plain authenticator failed for ([118.26.153.102]) [118.26.153.102]:33590: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 29 01:13:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.111.221
description:
47.128.111.221 - - [29/Jan/2025:01:14:11 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6299801 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=73" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.111.221


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Jan 29 01:14:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-01-29 01:14:22 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:54866: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.175
description:
47.128.16.175 - - [29/Jan/2025:01:14:43 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18545731 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?duration=short%2Cmedium&filter_course-language=183&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.81.140.83
description:
2025-01-29 01:15:35 dovecot_plain authenticator failed for ([42.81.140.83]) [42.81.140.83]:35862: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
description:
2025-01-29 01:15:48 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:30998: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.81.140.83
description:
Jan 29 01:15:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.81.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-01-29 01:15:46 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:49758: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Jan 29 01:15:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
description:
Jan 29 01:15:46 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.50.14
description:
2025-01-29 01:16:49 dovecot_plain authenticator failed for (201-91-49-72.customer.tdatabrasil.net.br) [187.92.50.14]:38600: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-29 01:16:19 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:37409: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-29 01:16:22 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:49376: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.50.14
description:
Jan 29 01:16:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.50.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.94.121.85
description:
2025-01-29 01:16:04 dovecot_plain authenticator failed for ([115.94.121.85]) [115.94.121.85]:38823: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-29 01:16:08 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:60122: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 29 01:16:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-29 01:16:13 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:47863: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 29 01:16:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.55
description:
Jan 29 01:16:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.16.230
description:
2025-01-29 01:15:56 dovecot_plain authenticator failed for 111-70-16-230.emome-ip.hinet.net [111.70.16.230]:54428: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 29 01:16:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-29 01:16:08 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.165.140]:41112: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-29 01:16:26 dovecot_login authenticator failed for ([223.26.225.129]) [210.206.24.234]:1458: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 29 01:16:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 29 01:16:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.94.121.85
description:
Jan 29 01:16:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.94.121.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-29 01:16:30 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:48485: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 29 01:16:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-29 01:16:37 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:54007: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.155.116.155
description:
2025-01-29 01:16:12 dovecot_login authenticator failed for 155.sub-166-155-116.myvzw.com [166.155.116.155]:61669: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 29 01:16:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.55
description:
2025-01-29 01:16:26 dovecot_login authenticator failed for ([104.241.236.55]) [104.241.236.55]:46543: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.16.230
description:
Jan 29 01:15:54 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.16.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 29 01:16:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.158
description:
Jan 29 01:17:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-29 01:17:23 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:56042: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 29 01:17:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.37.101.117
description:
2025-01-29 01:17:52 dovecot_login authenticator failed for ([104.37.101.117]) [104.37.101.117]:36062: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Jan 29 01:17:18 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 29 01:17:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Jan 29 01:17:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-01-29 01:17:30 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:54120: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
description:
2025-01-29 01:17:43 dovecot_plain authenticator failed for (namatoness) [65.20.204.164]:46724: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-01-29 01:17:20 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:52490: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 29 01:17:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.101.117
description:
Jan 29 01:17:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.101.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-29 01:16:59 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:36874: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 29 01:17:21 ait sshd[4015238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Jan 29 01:17:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-01-29 01:17:41 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:60564: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.247.90
description:
Jan 29 01:17:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.164
description:
Jan 29 01:17:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 01:17:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 29 01:16:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 29 01:17:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-29 01:17:04 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:1881: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.247.90
description:
2025-01-29 01:17:19 dovecot_login authenticator failed for ([36.154.247.90]) [36.154.247.90]:56697: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.190
description:
Jan 29 01:17:37 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.158
description:
2025-01-29 01:17:12 dovecot_login authenticator failed for ([104.241.230.158]) [104.241.230.158]:39252: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 29 01:17:21 ait sshd[4015238]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.190
description:
2025-01-29 01:17:39 dovecot_plain authenticator failed for (bodrosed) [2.110.10.190]:32804: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-29 01:17:40 dovecot_login authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:62057: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 29 01:17:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-29 01:18:18 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:49764: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 29 01:18:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.66.224
description:
Jan 29 01:18:12 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.66.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Jan 29 01:18:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 29 01:18:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
description:
2025-01-29 01:18:40 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:12800: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.205.244.221
description:
Jan 29 01:18:01 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.205.244.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 29 01:18:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
description:
Jan 29 01:18:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-01-29 01:18:23 dovecot_login authenticator failed for ([203.193.168.181]) [203.193.168.181]:40394: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.54.17
description:
Jan 29 01:18:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.54.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 29 01:18:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-29 01:18:36 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:39040: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
description:
2025-01-29 01:18:42 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:37874: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.205.244.221
description:
2025-01-29 01:18:03 dovecot_login authenticator failed for (191-205-244-221.user.vivozap.com.br) [191.205.244.221]:26221: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
description:
2025-01-29 01:18:29 dovecot_login authenticator failed for (17.54.gonzagatelecom.com.br) [177.128.54.17]:44736: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.135.6.10
description:
Jan 29 01:18:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.135.6.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
description:
Jan 29 01:18:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
description:
2025-01-29 01:18:52 dovecot_login authenticator failed for ([111.61.87.152]) [111.61.87.152]:42038: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.66.224
description:
2025-01-29 01:18:14 dovecot_plain authenticator failed for ([94.204.66.224]) [94.204.66.224]:60278: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-29 01:18:29 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:33076: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 29 01:19:01 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 29 01:19:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 29 01:19:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.110.194
description:
Jan 29 01:19:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.110.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 29 01:19:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 29 01:18:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-29 01:18:58 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (trapty) [109.67.154.24]:51708: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-29 01:19:06 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:58888: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-29 01:19:04 dovecot_login authenticator failed for (undefined.hostname.localhost) [182.76.87.90]:37416: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-29 01:20:11 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:33687: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 01:20:22 ait sshd[4016302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-29 01:20:24 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:52348: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
description:
2025-01-29 01:20:25 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:58707: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-01-29 01:20:25 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:38823: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 29 01:20:29 ait sshd[4016397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=ftp


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-29 01:19:55 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:21006: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.29.254
description:
47.128.29.254 - - [29/Jan/2025:01:20:36 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28637043 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=120%2C183%2C121%2C79&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.37
description:
Jan 29 01:20:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
description:
2025-01-29 01:20:37 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:35744: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Jan 29 01:20:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
description:
Jan 29 01:20:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 29 01:20:29 ait sshd[4016397]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.62.3
description:
2025-01-29 01:20:41 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:58394: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.2.14
description:
2025-01-29 01:20:49 dovecot_login authenticator failed for cm-staticip-85-152-2-14.telecable.es [85.152.2.14]:52106: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-29 01:20:22 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:53569: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.213
description:
2025-01-29 01:20:44 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:34778: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-29 01:20:47 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:41350: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-29 01:20:09 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:32938: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 29 01:20:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-29 01:20:08 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:58290: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 29 01:20:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.62.3
description:
Jan 29 01:20:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.62.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.213
description:
Jan 29 01:20:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 29 01:20:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Jan 29 01:20:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.2.14
description:
Jan 29 01:20:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.2.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 01:20:21 ait sshd[4016302]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 29 01:20:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.37
description:
2025-01-29 01:20:34 dovecot_login authenticator failed for ([104.241.233.37]) [104.241.233.37]:60521: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 29 01:20:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.39.73.186
description:
2025-01-29 01:20:07 dovecot_login authenticator failed for (static-50-39-73-186.bvtn.or.ptr.ziplyfiber.com) [50.39.73.186]:56312: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 29 01:20:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.39.73.186
description:
Jan 29 01:20:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.39.73.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 29 01:20:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 29 01:21:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
description:
Jan 29 01:21:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 29 01:21:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-29 01:21:32 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:42123: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 01:21:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
description:
2025-01-29 01:20:59 dovecot_login authenticator failed for (Mail.chinaqiaoyu.com) [222.185.255.227]:49951: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.250.208
description:
2025-01-29 01:21:21 dovecot_login authenticator failed for (mx-ll-183.89.250-208.dynamic.3bb.in.th) [183.89.250.208]:54265: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
description:
2025-01-29 01:21:30 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:45716: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-29 01:21:32 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:44940: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 29 01:21:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-01-29 01:21:04 dovecot_login authenticator failed for ([14.37.79.247]) [14.37.79.247]:33147: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
description:
Jan 29 01:21:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 29 01:21:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-20.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-29 01:21:16 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:45362: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-29 01:21:46 dovecot_plain authenticator failed for ([121.142.146.167]) [121.142.146.167]:34274: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
description:
Jan 29 01:20:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 29 01:21:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Jan 29 01:21:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 01:21:32 ait sshd[4016905]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 01:21:32 ait sshd[4016905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 29 01:21:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 29 01:20:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.250.208
description:
Jan 29 01:21:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.250.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-29 01:21:52 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:23066: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-01-29 01:21:55 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:44136: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 01:22:01 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-29 01:22:23 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:39874: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 29 01:22:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-29 01:22:38 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:45570: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.39.73.186
description:
Jan 29 01:22:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.39.73.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.39.73.186
description:
2025-01-29 01:22:38 dovecot_login authenticator failed for (static-50-39-73-186.bvtn.or.ptr.ziplyfiber.com) [50.39.73.186]:33456: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 29 01:22:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
description:
Jan 29 01:22:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 29 01:22:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Jan 29 01:22:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-29 01:22:36 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:36275: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 29 01:22:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-01-29 01:22:48 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:32915: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-29 01:22:23 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:42368: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.77.21.39
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-22.51.77.21.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Jan 29 01:21:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-29 01:22:06 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:57544: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 29 01:22:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 01:22:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-01-29 01:21:59 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:38701: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
description:
2025-01-29 01:22:19 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:64698: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-01-29 01:22:31 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:43152: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 29 01:22:46 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.215.126.22
description:
Jan 29 01:23:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.215.126.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-29 01:23:46 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (denon) [109.67.154.24]:48576: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 29 01:23:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-01-29 01:23:30 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:37419: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 29 01:23:18 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Jan 29 01:23:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 29 01:23:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-29 01:22:57 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (chirong) [81.225.30.107]:57243: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Jan 29 01:23:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-01-29 01:23:02 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:38782: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-29 01:23:20 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:40722: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-29 01:23:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (exoglaing) [87.103.126.54]:45300: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 29 01:22:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.163.194
description:
Jan 29 01:23:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.163.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.163.194
description:
2025-01-29 01:23:18 dovecot_plain authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:59725: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.215.126.22
description:
2025-01-29 01:23:37 dovecot_plain authenticator failed for ([60.215.126.22]) [60.215.126.22]:35936: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-29 01:24:31 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:36316: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Jan 29 01:24:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
description:
Jan 29 01:24:46 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.130.140.4
description:
Jan 29 01:24:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.130.140.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
description:
2025-01-29 01:24:48 dovecot_login authenticator failed for ([218.6.160.15]) [218.6.160.15]:36867: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 29 01:24:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-01-29 01:24:35 dovecot_login authenticator failed for ([124.115.217.162]) [124.115.217.162]:50324: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.130.140.4
description:
2025-01-29 01:24:49 dovecot_login authenticator failed for 64-130-140-4.pool.dsl.scrtc.com [64.130.140.4]:51682: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.172.79.198
description:
Jan 29 01:25:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.172.79.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-29 01:25:28 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:57700: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
description:
2025-01-29 01:25:13 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:60392: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Jan 29 01:25:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.114.176
description:
Jan 29 01:26:09 ait sshd[4018589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.114.176


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.73.42.142
description:
Jan 29 01:26:03 ait sshd[4018558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.73.42.142


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.114.176
description:
Jan 29 01:26:09 ait sshd[4018589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.114.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-01-29 01:26:23 dovecot_login authenticator failed for ([125.72.92.174]) [125.72.92.174]:54690: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-29 01:26:36 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:60678: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.73.42.142
description:
Jan 29 01:26:03 ait sshd[4018558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.73.42.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-29 01:27:41 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:53304: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-01-29 01:27:47 dovecot_login authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:43694: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.83
description:
Jan 29 01:27:25 ait sshd[4019097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 29 01:27:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 29 01:27:12 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.105.217
description:
2025-01-29 01:27:48 dovecot_plain authenticator failed for ([163.179.105.217]) [163.179.105.217]:53196: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-29 01:27:27 dovecot_login authenticator failed for ([41.93.113.138]) [41.93.113.138]:44802: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.245.67
description:
2025-01-29 01:27:08 dovecot_login authenticator failed for ([120.238.245.67]) [120.238.245.67]:39465: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.189
description:
2025-01-29 01:27:28 dovecot_login authenticator failed for ([111.61.176.189]) [111.61.176.189]:28762: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-29 01:27:37 dovecot_login authenticator failed for ([116.113.254.26]) [116.113.254.26]:33510: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-01-29 01:27:44 dovecot_login authenticator failed for ([221.181.210.98]) [221.181.210.98]:35423: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.220.244.68
description:
Jan 29 01:27:48 ait sshd[4019296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.220.244.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-01-29 01:27:03 dovecot_plain authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:36278: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-29 01:27:19 dovecot_plain authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:44813: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
description:
2025-01-29 01:27:25 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:42191: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-29 01:27:27 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:41303: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-29 01:27:14 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:38495: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.189
description:
Jan 29 01:27:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.220.244.68
description:
Jan 29 01:27:48 ait sshd[4019296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.220.244.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.195
description:
2025-01-29 01:27:22 dovecot_login authenticator failed for 111-70-41-195.emome-ip.hinet.net [111.70.41.195]:54998: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-29 01:27:23 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:51184: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 29 01:27:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.83
description:
Jan 29 01:27:25 ait sshd[4019097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-01-29 01:27:32 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:41997: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.199.75
description:
Jan 29 01:27:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.199.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.41.195
description:
Jan 29 01:27:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.41.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 29 01:27:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-01-29 01:28:39 dovecot_login authenticator failed for ([119.32.11.3]) [119.32.11.3]:19473: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.240
description:
2025-01-29 01:28:04 dovecot_login authenticator failed for 111-70-13-240.emome-ip.hinet.net [111.70.13.240]:48405: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
description:
2025-01-29 01:28:07 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:34120: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Jan 29 01:28:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.170.5.210
description:
2025-01-29 01:28:16 dovecot_plain authenticator failed for ([39.170.5.210]) [39.170.5.210]:54728: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
description:
2025-01-29 01:28:29 dovecot_plain authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:60906: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.13.240
description:
Jan 29 01:28:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.13.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
description:
2025-01-29 01:28:02 dovecot_login authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:40394: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
description:
2025-01-29 01:28:11 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:46130: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.110.127.224
description:
Jan 29 01:28:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.110.127.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-29 01:28:42 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:57275: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-29 01:28:52 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:45160: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.184.18
description:
2025-01-29 01:28:17 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:45132: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-29 01:28:26 dovecot_login authenticator failed for ([36.134.78.151]) [36.134.78.151]:57292: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-01-29 01:28:28 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2203: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.110.127.224
description:
2025-01-29 01:28:34 dovecot_plain authenticator failed for ([183.71.251.66]) [14.110.127.224]:37869: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-01-29 01:28:40 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:24928: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
description:
2025-01-29 01:28:47 dovecot_plain authenticator failed for ([222.99.237.249]) [222.99.237.249]:55054: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
description:
2025-01-29 01:28:01 dovecot_login authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:48253: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
description:
2025-01-29 01:28:08 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:36458: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.222.184.18
description:
Jan 29 01:28:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.222.184.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.26.136.52
description:
Jan 29 01:29:28 ait sshd[4019687]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.26.136.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.49.225.218
description:
2025-01-29 01:29:29 dovecot_plain authenticator failed for (161.49.225.218.convergeict.com) [161.49.225.218]:43464: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
description:
Jan 29 01:29:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
description:
2025-01-29 01:29:17 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:53126: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.26.136.52
description:
Jan 29 01:29:28 ait sshd[4019687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.26.136.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-29 01:29:44 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:45199: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
description:
2025-01-29 01:29:53 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:2482: 535 Incorrect authentication data (set_id=ads22b22265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.95
description:
Jan 29 01:28:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.95
description:
2025-01-29 01:29:01 dovecot_login authenticator failed for 111-70-3-95.emome-ip.hinet.net [111.70.3.95]:43682: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-01-29 01:29:55 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:3268: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.228.131
description:
2025-01-29 01:30:39 dovecot_plain authenticator failed for ([183.99.228.131]) [183.99.228.131]:43750: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-29 01:29:57 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:44939: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-29 01:30:10 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:51384: 535 Incorrect authentication data (set_id=ads22b22265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-29 01:30:42 dovecot_plain authenticator failed for (trader) [81.211.77.58]:22392: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-01-29 01:30:52 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:37913: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.220.244.68
description:
Jan 29 01:30:55 ait sshd[4020305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.220.244.68


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.114.176
description:
Jan 29 01:31:43 ait sshd[4020552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.114.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.114.176
description:
Jan 29 01:31:43 ait sshd[4020552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.114.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
description:
2025-01-29 01:31:24 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:33820: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.240
description:
Jan 29 01:31:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-29 01:31:52 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:33822: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.220.244.68
description:
Jan 29 01:30:55 ait sshd[4020305]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.220.244.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-29 01:31:08 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:44338: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.73.42.142
description:
Jan 29 01:31:41 ait sshd[4020546]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.73.42.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 29 01:31:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:yhawchino57@email.com||WPU:yhawchino57@email.com||RSV:6.65||T:APACHE||MV:01-31.170.205.31.125


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 01:31:48 ait sshd[4020682]: Invalid user createursdespoir.net 2600 from 111.231.56.128 port 52748


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 01:31:49 ait sshd[4020682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.26.136.52
description:
Jan 29 01:31:32 ait sshd[4020530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.26.136.52


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.73.42.142
description:
Jan 29 01:31:41 ait sshd[4020546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.73.42.142


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.209.173.203
description:
2025-01-29 01:31:41 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:64028: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 01:31:49 ait sshd[4020682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.240
description:
2025-01-29 01:31:46 dovecot_plain authenticator failed for 111-70-21-240.emome-ip.hinet.net [111.70.21.240]:50068: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.26.136.52
description:
Jan 29 01:31:32 ait sshd[4020530]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.26.136.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-29 01:31:35 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:37236: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.209.173.203
description:
Jan 29 01:31:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.209.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-29 01:32:41 dovecot_login authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:47202: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-29 01:32:44 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:4665: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.83
description:
Jan 29 01:32:09 ait sshd[4020752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.83


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.73.42.142
description:
Jan 29 01:32:31 ait sshd[4020863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.73.42.142


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.220.244.68
description:
Jan 29 01:32:33 ait sshd[4020890]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.220.244.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.83
description:
Jan 29 01:32:09 ait sshd[4020752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 01:32:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.73.42.142
description:
Jan 29 01:32:31 ait sshd[4020863]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.73.42.142 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.73.42.142
description:
Jan 29 01:32:33 ait sshd[4020863]: Failed password for invalid user ftpuser from 49.73.42.142 port 40446 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 29 01:32:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-01-29 01:32:29 dovecot_login authenticator failed for ([185.199.98.51]) [185.199.98.51]:44368: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.220.244.68
description:
Jan 29 01:32:33 ait sshd[4020890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.220.244.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 29 01:32:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.26.136.52
description:
Jan 29 01:33:06 ait sshd[4021305]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.26.136.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.149.83.62
description:
Jan 29 01:33:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.149.83.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
description:
Jan 29 01:33:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.203.203.66
description:
Jan 29 01:33:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.203.203.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.118
description:
Jan 29 01:33:46 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
description:
2025-01-29 01:33:48 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:20798: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 29 01:33:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.114.176
description:
Jan 29 01:33:33 ait sshd[4021468]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.114.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.232.68.50
description:
Jan 29 01:33:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.232.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.128.123.34
description:
Jan 29 01:33:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.128.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.255.96.29
description:
Jan 29 01:33:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.255.96.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.193.127
description:
Jan 29 01:33:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.193.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.181.195.26
description:
Jan 29 01:33:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.181.195.26 has been locked due to Imunify RBL


