# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.81.140.83
description:
Jan 30 21:04:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.81.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-01-30 21:04:45 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:43707: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 30 21:04:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-30 21:04:59 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:36284: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.26
description:
2025-01-30 21:05:11 dovecot_plain authenticator failed for ([42.180.162.26]) [42.180.162.26]:52086: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-30 21:05:20 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:50586: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 30 21:04:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.26
description:
Jan 30 21:05:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 30 21:04:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.240.23
description:
[2025-01-30 21:04:37 +0100] info [webmaild] 187.108.240.23 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.34.147
description:
Jan 30 21:05:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.34.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.79.83.28
description:
Jan 30 21:05:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.79.83.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.71.44.229
description:
Jan 30 21:05:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.71.44.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.79.83.28
description:
2025-01-30 21:05:27 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:59208: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.130.8
description:
[2025-01-30 21:05:19 +0100] info [webmaild] 186.249.130.8 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Jan 30 21:04:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Jan 30 21:04:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.71.44.229
description:
2025-01-30 21:05:07 dovecot_login authenticator failed for 82-71-44-229.dsl.in-addr.zen.co.uk ([127.0.0.1]) [82.71.44.229]:35422: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.34
description:
2025-01-30 21:06:02 dovecot_plain authenticator failed for ([42.180.162.34]) [42.180.162.34]:37074: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.28.125.96
description:
Jan 30 21:06:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.28.125.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-30 21:05:39 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:60894: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Jan 30 21:06:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.197.38
description:
2025-01-30 21:06:21 dovecot_plain authenticator failed for ([117.211.197.38]) [117.211.197.38]:41302: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.34
description:
Jan 30 21:06:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-01-30 21:05:51 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:38941: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-01-30 21:06:11 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:63638: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 30 21:05:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
description:
Jan 30 21:05:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.197.38
description:
Jan 30 21:06:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.28.125.96
description:
2025-01-30 21:06:31 dovecot_plain authenticator failed for ([38.28.125.96]) [38.28.125.96]:42095: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-30 21:07:18 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:59521: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
description:
Jan 30 21:07:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.171.150
description:
Jan 30 21:07:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.171.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-01-30 21:07:05 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:57458: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
description:
2025-01-30 21:07:25 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:50960: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 30 21:06:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-30 21:06:46 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:18189: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Jan 30 21:07:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 30 21:07:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.171.150
description:
2025-01-30 21:07:32 dovecot_plain authenticator failed for ([221.0.171.150]) [221.0.171.150]:49536: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
description:
2025-01-30 21:08:53 dovecot_plain authenticator failed for ([221.146.186.122]) [221.146.186.122]:52616: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 30 21:09:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-30 21:09:16 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:50411: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
description:
2025-01-30 21:09:21 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:32900: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.215.162
description:
Jan 30 21:09:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.215.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
description:
Jan 30 21:08:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.82.251.73
description:
Jan 30 21:08:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.82.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 30 21:08:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.43.143
description:
Jan 30 21:09:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.113.43.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Jan 30 21:08:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-30 21:08:59 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:43748: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 43.245.86.95
description:
[2025-01-30 21:09:25 +0100] info [webmaild] 43.245.86.95 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.82.251.73
description:
2025-01-30 21:08:44 dovecot_plain authenticator failed for syn-071-082-251-073.res.spectrum.com [71.82.251.73]:41607: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-01-30 21:08:33 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:59420: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.215.162
description:
Jan 30 21:09:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.215.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-30 21:09:50 dovecot_plain authenticator failed for ([58.218.163.130]) [58.218.163.130]:58054: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
description:
2025-01-30 21:10:03 dovecot_plain authenticator failed for ([118.91.176.243]) [118.91.176.243]:48956: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 30 21:10:27 ait sshd[1158335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
description:
Jan 30 21:09:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 30 21:09:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.91.176.243
description:
Jan 30 21:10:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.91.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 21:10:27 ait sshd[1158335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
description:
2025-01-30 21:09:34 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:47069: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.230.59.212
description:
[2025-01-30 21:10:37 +0100] info [webmaild] 88.230.59.212 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.175.48.5
description:
Jan 30 21:10:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.175.48.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
description:
Jan 30 21:11:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
description:
2025-01-30 21:11:07 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:54195: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 21:10:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.175.48.5
description:
2025-01-30 21:10:54 dovecot_plain authenticator failed for ([39.175.48.5]) [39.175.48.5]:2401: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-30 21:12:07 dovecot_plain authenticator failed for ([218.28.77.206]) [218.28.77.206]:55476: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Jan 30 21:12:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-30 21:12:25 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:42426: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-30 21:12:08 dovecot_plain authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:10858: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-01-30 21:12:19 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:58590: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 30 21:12:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
description:
Jan 30 21:11:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
description:
2025-01-30 21:11:58 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:55658: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 30 21:12:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 30 21:12:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
description:
2025-01-30 21:12:47 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:56667: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
description:
2025-01-30 21:12:58 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:53854: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
description:
Jan 30 21:13:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.40.138
description:
Jan 30 21:12:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.40.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-01-30 21:12:42 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:33414: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Jan 30 21:12:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 21:13:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Jan 30 21:12:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
description:
Jan 30 21:12:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
description:
Jan 30 21:12:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 21:13:03 ait sshd[1159378]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.150.236.203
description:
Jan 30 21:13:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.150.236.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.150.236.203
description:
2025-01-30 21:13:10 dovecot_plain authenticator failed for ([62.150.236.203]) [62.150.236.203]:44831: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
description:
2025-01-30 21:13:19 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:57616: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
description:
2025-01-30 21:12:33 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:46222: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-01-30 21:12:53 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:58169: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 21:13:03 ait sshd[1159378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.70.23.199
description:
[2025-01-30 21:12:31 +0100] info [webmaild] 186.70.23.199 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-01-30 21:14:03 dovecot_plain authenticator failed for ([179.185.1.177]) [179.185.1.177]:48299: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Jan 30 21:14:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-13.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.14
description:
2025-01-30 21:14:30 dovecot_plain authenticator failed for ([124.115.231.14]) [124.115.231.14]:59354: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Jan 30 21:13:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
description:
Jan 30 21:14:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 30 21:14:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-30 21:14:09 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:21302: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
description:
2025-01-30 21:14:15 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:53344: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.22.41
description:
[2025-01-30 21:13:50 +0100] info [webmaild] 186.237.22.41 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-01-30 21:13:53 dovecot_plain authenticator failed for ([110.35.63.30]) [110.35.63.30]:47334: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.83
description:
47.128.121.83 - - [30/Jan/2025:21:13:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17775583 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?duration=short&filter_course-category=61&filtering=1&level=intermediate%2Cbeginner%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Jan 30 21:14:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-01-30 21:14:07 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:46244: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.14
description:
Jan 30 21:14:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-01-30 21:14:34 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:45842: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-30 21:14:48 dovecot_plain authenticator failed for (evericric) [178.250.191.189]:40888: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 21:14:53 dovecot_plain authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:60010: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.10.67.106
description:
[2025-01-30 21:15:25 +0100] info [webmaild] 177.10.67.106 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Jan 30 21:14:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 30 21:14:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 21:14:45 ait sshd[1160252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-01-30 21:14:48 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:59487: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.0.119
description:
2025-01-30 21:15:01 dovecot_plain authenticator failed for ([221.162.0.119]) [221.162.0.119]:41700: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-30 21:15:06 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:55798: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Jan 30 21:14:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 21:14:45 ait sshd[1160252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.0.119
description:
Jan 30 21:14:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.0.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.96.62.29
description:
Jan 30 21:15:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.96.62.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-30 21:14:53 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:54063: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-01-30 21:15:15 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:57984: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Jan 30 21:15:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
description:
2025-01-30 21:14:43 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:23058: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 21:14:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
description:
2025-01-30 21:15:23 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:43466: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-01-30 21:15:24 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:42782: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
description:
Jan 30 21:14:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 30 21:14:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 30 21:15:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Jan 30 21:15:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-01-30 21:15:34 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:34053: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-01-30 21:15:50 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:60774: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 30 21:15:44 ait sshd[1160786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 30 21:16:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-30 21:16:06 dovecot_plain authenticator failed for ([175.210.74.19]) [175.210.74.19]:49782: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Jan 30 21:15:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Jan 30 21:15:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 30 21:15:44 ait sshd[1160786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.23.115.162
description:
[2025-01-30 21:16:18 +0100] info [webmaild] 177.23.115.162 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-30 21:16:41 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (monobiline) [217.215.254.115]:35912: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.193
description:
2025-01-30 21:17:17 dovecot_login authenticator failed for 110-25-104-193.adsl.fetnet.net [110.25.104.193]:50372: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.212.236.72
description:
[2025-01-30 21:17:27 +0100] info [webmaild] 102.212.236.72 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Jan 30 21:16:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.193
description:
Jan 30 21:17:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-01-30 21:18:27 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:61794: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 30 21:17:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 21:18:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 30 21:18:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.148.232
description:
Jan 30 21:18:24 ait sshd[1161714]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.42.148.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-30 21:18:11 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:43018: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-30 21:18:22 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:36336: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 30 21:18:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.171.227.46
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS21A00069Y@AIT.EDU.GH||WPU:ADS21A00069Y@AIT.EDU.GH||RSV:6.65||T:APACHE||MV:21-18.83.171.227.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Jan 30 21:18:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.42.148.232
description:
Jan 30 21:18:24 ait sshd[1161714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.42.148.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-30 21:17:34 dovecot_login authenticator failed for ([58.229.51.205]) [58.229.51.205]:44716: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 21:18:21 ait sshd[1161712]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 21:18:21 ait sshd[1161712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.125.220.59
description:
[2025-01-30 21:18:26 +0100] info [webmaild] 45.125.220.59 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.30.170
description:
Jan 30 21:19:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.30.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 21:19:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.148.232
description:
Jan 30 21:18:35 ait sshd[1161760]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.42.148.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
description:
2025-01-30 21:19:04 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:38444: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-01-30 21:18:37 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:52886: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.66.249.234
description:
Jan 30 21:18:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.66.249.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
description:
2025-01-30 21:19:12 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:55584: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Jan 30 21:19:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
description:
Jan 30 21:18:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.42.148.232
description:
Jan 30 21:18:35 ait sshd[1161760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.42.148.232  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
description:
Jan 30 21:19:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.66.249.234
description:
2025-01-30 21:18:52 dovecot_plain authenticator failed for 92-66-249-234.biz.kpn.net [92.66.249.234]:38848: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-01-30 21:19:31 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:47768: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.180.49
description:
[2025-01-30 21:19:41 +0100] info [webmaild] 177.185.180.49 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.207.152.163
description:
Jan 30 21:19:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.207.152.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
description:
Jan 30 21:20:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.241.7
description:
[2025-01-30 21:20:30 +0100] info [webmaild] 177.37.241.7 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
description:
2025-01-30 21:20:08 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:40474: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
description:
Jan 30 21:20:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
description:
2025-01-30 21:20:30 dovecot_plain authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:4211: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.163
description:
2025-01-30 21:19:58 dovecot_plain authenticator failed for ([102.207.152.163]) [102.207.152.163]:37473: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 21:20:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 21:20:27 dovecot_plain authenticator failed for (notlize) [207.188.157.230]:57434: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 21:19:32 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (gadatares) [91.56.31.167]:60000: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Jan 30 21:20:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-01-30 21:20:56 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:50677: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 30 21:20:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 30 21:21:20 ait sshd[1163404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 30 21:21:20 ait sshd[1163404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-01-30 21:20:46 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:39618: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.207.227.7
description:
Jan 30 21:21:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.207.227.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 30 21:20:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.227.76
description:
Jan 30 21:20:41 ait sshd[1162957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.227.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-30 21:20:42 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:16012: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Jan 30 21:20:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Jan 30 21:20:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.207.227.7
description:
2025-01-30 21:21:08 dovecot_login authenticator failed for (ait.edu.gh) [197.207.227.7]:50235: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.227.76
description:
Jan 30 21:20:41 ait sshd[1162957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.227.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-01-30 21:20:54 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:57242: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-30 21:21:01 dovecot_plain authenticator failed for ([222.186.68.153]) [222.186.68.153]:49289: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.153
description:
2025-01-30 21:21:29 dovecot_login authenticator failed for (ADMIN) [188.126.89.153]:59402: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 30 21:21:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-30 21:21:57 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:50086: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.247.90.194
description:
Jan 30 21:22:12 ait sshd[1163702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.247.90.194


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.66.25
description:
Jan 30 21:22:15 ait sshd[1163712]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.66.25 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.66.25
description:
Jan 30 21:22:15 ait sshd[1163712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.66.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
description:
2025-01-30 21:22:20 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:34143: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.242.198.96
description:
[2025-01-30 21:21:35 +0100] info [webmaild] 91.242.198.96 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 21:22:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.247.90.194
description:
Jan 30 21:22:12 ait sshd[1163702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.247.90.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
description:
Jan 30 21:22:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.105.198.184
description:
[2025-01-30 21:22:42 +0100] info [webmaild] 176.105.198.184 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-30 21:22:46 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com (prelties) [131.106.31.52]:43270: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
description:
Jan 30 21:23:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-30 21:23:07 dovecot_plain authenticator failed for ([182.70.120.127]) [182.70.120.127]:57200: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 30 21:22:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.125.200
description:
Jan 30 21:23:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
description:
2025-01-30 21:23:05 dovecot_plain authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:40392: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 30 21:23:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-30 21:23:15 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:27025: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.246.112.254
description:
Jan 30 21:23:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.246.112.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.246.112.254
description:
2025-01-30 21:23:22 dovecot_plain authenticator failed for nz112l254.bb60246.ctm.net [60.246.112.254]:40307: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.105.142
description:
[2025-01-30 21:23:43 +0100] info [webmaild] 170.82.105.142 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.183.223
description:
Jan 30 21:24:10 ait sshd[1164329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.183.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 30 21:24:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-30 21:24:18 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:48580: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Jan 30 21:24:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.183.223
description:
Jan 30 21:24:10 ait sshd[1164329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.183.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.69.243.130
description:
Jan 30 21:24:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.69.243.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-01-30 21:24:31 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:58657: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.157.206.202
description:
Jan 30 21:24:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.157.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Jan 30 21:24:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-01-30 21:24:59 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:21324: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
description:
2025-01-30 21:25:20 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:52542: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.69.243.130
description:
2025-01-30 21:24:33 dovecot_login authenticator failed for ([127.0.0.1]) [39.69.243.130]:54358: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.54.46.137
description:
[2025-01-30 21:24:34 +0100] info [webmaild] 186.54.46.137 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 30 21:24:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-30 21:24:38 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (alvic) [83.254.126.238]:33304: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 21:24:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
description:
Jan 30 21:25:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Jan 30 21:25:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
description:
2025-01-30 21:25:21 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:33328: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.206.202
description:
2025-01-30 21:24:44 dovecot_login authenticator failed for ([127.0.0.1]) [120.157.206.202]:40933: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.56.200
description:
[2025-01-30 21:25:51 +0100] info [webmaild] 45.167.56.200 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.227.76
description:
Jan 30 21:26:03 ait sshd[1165325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.227.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-30 21:26:19 dovecot_plain authenticator failed for ([222.161.242.146]) [222.161.242.146]:7627: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-30 21:25:36 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:27907: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
description:
Jan 30 21:25:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.227.76
description:
Jan 30 21:26:03 ait sshd[1165325]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.227.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
description:
Jan 30 21:26:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.66.25
description:
Jan 30 21:25:47 ait sshd[1165015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.66.25 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.66.25
description:
Jan 30 21:25:47 ait sshd[1165015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.66.25


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.183.223
description:
Jan 30 21:25:54 ait sshd[1165141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.183.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.183.223
description:
Jan 30 21:25:54 ait sshd[1165141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.183.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 30 21:26:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 30 21:25:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
description:
2025-01-30 21:25:40 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (unprosm) [80.14.31.158]:59239: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
description:
2025-01-30 21:26:20 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:56152: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 30 21:26:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.208.138
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:21-26.173.212.208.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-30 21:26:04 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:52000: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-26.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.247.90.194
description:
Jan 30 21:26:58 ait sshd[1165628]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.247.90.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
description:
Jan 30 21:27:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.190.243
description:
Jan 30 21:26:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.190.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 21:26:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.66.25
description:
Jan 30 21:26:54 ait sshd[1165571]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.66.25 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.66.25
description:
Jan 30 21:26:56 ait sshd[1165571]: Failed password for invalid user yam from 68.183.66.25 port 48652 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.183.223
description:
Jan 30 21:27:21 ait sshd[1165704]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.183.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
description:
Jan 30 21:27:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
description:
2025-01-30 21:27:26 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:41362: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.47
description:
Jan 30 21:26:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
description:
2025-01-30 21:27:03 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:36294: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
description:
2025-01-30 21:27:13 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:37860: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.190.243
description:
2025-01-30 21:26:34 dovecot_plain authenticator failed for ([221.162.190.243]) [221.162.190.243]:42139: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.66.25
description:
Jan 30 21:26:54 ait sshd[1165571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.66.25


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
description:
Jan 30 21:27:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.247.90.194
description:
Jan 30 21:26:58 ait sshd[1165628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.247.90.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
description:
Jan 30 21:26:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
description:
2025-01-30 21:26:35 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:56360: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.232.3
description:
[2025-01-30 21:26:47 +0100] info [webmaild] 181.94.232.3 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.47
description:
2025-01-30 21:27:00 dovecot_plain authenticator failed for (pesious) [65.20.193.47]:35323: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.183.223
description:
Jan 30 21:27:21 ait sshd[1165704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.183.223


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-01-30 21:27:35 dovecot_login authenticator failed for (199.35.89.239.bcube.co.uk) [89.35.199.239]:51400: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Jan 30 21:27:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.251.42
description:
[2025-01-30 21:27:54 +0100] info [webmaild] 45.166.251.42 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
description:
Jan 30 21:28:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.227.76
description:
Jan 30 21:27:32 ait sshd[1165749]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.227.76 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.227.76
description:
Jan 30 21:27:32 ait sshd[1165749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.227.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-30 21:28:23 dovecot_plain authenticator failed for ([175.182.64.203]) [175.182.64.203]:36524: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 30 21:28:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-30 21:28:30 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:55372: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
description:
Jan 30 21:27:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-01-30 21:27:44 dovecot_login authenticator failed for ([31.173.9.222]) [31.173.9.222]:39938: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
description:
2025-01-30 21:28:08 dovecot_plain authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:54830: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 30 21:28:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.148.71
description:
2025-01-30 21:28:39 dovecot_plain authenticator failed for broadband-95-84-148-71.ip.moscow.rt.ru [95.84.148.71]:49206: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
description:
2025-01-30 21:28:53 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:36534: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.74.187
description:
Jan 30 21:28:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.74.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
description:
2025-01-30 21:28:42 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:36517: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
description:
Jan 30 21:28:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.247.90.194
description:
Jan 30 21:28:50 ait sshd[1166452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.247.90.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 21:29:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.157.24
description:
Jan 30 21:28:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.157.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.148.71
description:
Jan 30 21:28:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.148.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 30 21:29:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
description:
47.128.121.154 - - [30/Jan/2025:21:28:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17829407 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?filter_course-category=30&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-30 21:29:07 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:42570: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:21-28.104.209.253.237


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.28.0
description:
[2025-01-30 21:28:43 +0100] info [webmaild] 191.99.28.0 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.247.90.194
description:
Jan 30 21:28:50 ait sshd[1166452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.247.90.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 30 21:28:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-30 21:28:57 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:58485: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.157.24
description:
2025-01-30 21:28:36 dovecot_plain authenticator failed for ([218.14.157.24]) [218.14.157.24]:54917: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 21:29:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
description:
Jan 30 21:30:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Jan 30 21:30:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-01-30 21:30:17 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:46776: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.90.129.81
description:
[2025-01-30 21:29:38 +0100] info [whostmgrd] 164.90.129.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Jan 30 21:29:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-01-30 21:29:36 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:41277: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 21:29:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.0.149.125
description:
[2025-01-30 21:29:56 +0100] info [webmaild] 193.0.149.125 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
description:
2025-01-30 21:30:05 dovecot_plain authenticator failed for ([211.53.58.10]) [211.53.58.10]:60430: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.66.200
description:
Jan 30 21:31:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.66.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.66.200
description:
2025-01-30 21:31:03 dovecot_login authenticator failed for ([120.82.66.200]) [120.82.66.200]:60998: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.144.42.225
description:
Jan 30 21:30:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.144.42.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Jan 30 21:30:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.144.42.225
description:
2025-01-30 21:30:51 dovecot_plain authenticator failed for (TINY-1D00AC06) [136.144.42.225]:60932: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
description:
Jan 30 21:31:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-01-30 21:30:52 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:44230: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
description:
2025-01-30 21:31:26 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:55956: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.254.67
description:
[2025-01-30 21:30:52 +0100] info [webmaild] 45.184.254.67 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 30 21:31:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.12.44
description:
2025-01-30 21:31:35 dovecot_login authenticator failed for ([5.142.12.44]) [5.142.12.44]:49372: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
description:
2025-01-30 21:31:40 dovecot_login authenticator failed for ([170.81.14.113]) [170.81.14.113]:42949: 535 Incorrect authentication data (set_id=jaster@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
description:
Jan 30 21:31:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Jan 30 21:31:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.63.44
description:
[2025-01-30 21:31:55 +0100] info [webmaild] 179.108.63.44 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.105.16
description:
Jan 30 21:32:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.105.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.105.16
description:
2025-01-30 21:32:12 dovecot_login authenticator failed for host16.sub-63-46-105.myvzw.com [63.46.105.16]:53473: 535 Incorrect authentication data (set_id=jaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-30 21:31:31 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:45998: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.178
description:
Jan 30 21:32:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-30 21:31:41 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:34548: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 30 21:31:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-01-30 21:31:44 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:40596: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.178
description:
2025-01-30 21:32:30 dovecot_plain authenticator failed for ([197.250.7.67]) [41.220.129.178]:45686: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Jan 30 21:32:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 21:33:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Jan 30 21:33:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-01-30 21:33:18 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:22429: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-01-30 21:32:59 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:55935: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 30 21:33:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-30 21:33:13 dovecot_plain authenticator failed for (hesubed) [154.144.243.93]:35132: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.149.59
description:
Jan 30 21:32:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.149.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 21:33:10 dovecot_plain authenticator failed for (eming) [81.211.77.58]:13896: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Jan 30 21:33:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-01-30 21:33:18 dovecot_login authenticator failed for ([114.215.211.223]) [114.215.211.223]:48642: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
description:
2025-01-30 21:32:41 dovecot_plain authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:46136: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.109.162.130
description:
[2025-01-30 21:32:44 +0100] info [webmaild] 91.109.162.130 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 30 21:33:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-30 21:33:30 dovecot_plain authenticator failed for ([138.75.98.134]) [138.75.98.134]:42289: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.36.16.145
description:
2025-01-30 21:33:34 dovecot_plain authenticator failed for (ait.edu.gh) [177.36.16.145]:45893: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.93.10
description:
2025-01-30 21:33:47 dovecot_login authenticator failed for (User) [87.120.93.10]:46124: 535 Incorrect authentication data (set_id=admin@aitvarsity.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.151.156
description:
[2025-01-30 21:34:05 +0100] info [webmaild] 177.37.151.156 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.71.90.86
description:
[2025-01-30 21:35:03 +0100] info [webmaild] 185.71.90.86 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.212.183.97
description:
Jan 30 21:35:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.212.183.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.212.183.97
description:
2025-01-30 21:35:10 dovecot_plain authenticator failed for ([182.212.183.97]) [182.212.183.97]:49431: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Jan 30 21:35:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-01-30 21:35:27 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:58236: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 21:34:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-01-30 21:35:15 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:33846: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 21:34:40 dovecot_plain authenticator failed for (scired) [46.30.161.197]:34646: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.2.151.236
description:
Jan 30 21:35:10 ait sshd[1168992]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.2.151.236


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Jan 30 21:35:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Jan 30 21:35:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 30 21:35:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-01-30 21:35:02 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:22952: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-30 21:35:03 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:53020: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.2.151.236
description:
Jan 30 21:35:10 ait sshd[1168992]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.2.151.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.93.10
description:
2025-01-30 21:35:09 dovecot_login authenticator failed for (User) [87.120.93.10]:50222: 535 Incorrect authentication data (set_id=postmaster@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.236
description:
Jan 30 21:35:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.236
description:
2025-01-30 21:35:23 dovecot_plain authenticator failed for (nsg-corporate-236.227.187.122.airtel.in) [122.187.227.236]:54074: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.93.10
description:
2025-01-30 21:35:51 dovecot_login authenticator failed for (User) [87.120.93.10]:41592: 535 Incorrect authentication data (set_id=webmaster@aitvarsity.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.106.239.72
description:
[2025-01-30 21:36:26 +0100] info [webmaild] 103.106.239.72 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-01-30 21:35:54 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:45630: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Jan 30 21:36:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-01-30 21:36:06 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:36178: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 21:35:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Jan 30 21:35:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Jan 30 21:37:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.236.23.49
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-37.54.236.23.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-01-30 21:37:28 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:41151: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.203.113
description:
[2025-01-30 21:37:14 +0100] info [webmaild] 138.185.203.113 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 21:37:48 dovecot_plain authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:54396: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
description:
Jan 30 21:38:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 30 21:38:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.210.134.9
description:
2025-01-30 21:38:27 dovecot_plain authenticator failed for ([221.210.134.9]) [221.210.134.9]:35978: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Jan 30 21:38:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Jan 30 21:37:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-01-30 21:38:13 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:36587: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
description:
2025-01-30 21:38:15 dovecot_login authenticator failed for ([65.20.165.83]) [65.20.165.83]:47729: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 30 21:38:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-30 21:38:19 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:46944: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.210.134.9
description:
Jan 30 21:38:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.210.134.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
description:
2025-01-30 21:37:48 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:35906: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 30 21:38:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-01-30 21:37:41 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:42708: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
description:
Jan 30 21:38:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
description:
Jan 30 21:38:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
description:
2025-01-30 21:38:22 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:20628: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
description:
Jan 30 21:38:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.134.46.117
description:
[2025-01-30 21:38:15 +0100] info [webmaild] 186.134.46.117 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-30 21:38:02 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:50215: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
description:
2025-01-30 21:38:02 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:35315: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Jan 30 21:38:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-30 21:38:25 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:37598: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 21:37:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-01-30 21:38:31 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:50671: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-01-30 21:38:08 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:55852: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
description:
Jan 30 21:37:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.254.132.190
description:
[2025-01-30 21:39:08 +0100] info [webmaild] 46.254.132.190 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 21:38:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Jan 30 21:39:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Jan 30 21:39:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-01-30 21:39:40 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:52066: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
description:
Jan 30 21:39:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.117.14.162
description:
Jan 30 21:40:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.117.14.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-01-30 21:39:39 dovecot_plain authenticator failed for ([39.165.236.12]) [39.165.236.12]:52844: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
description:
2025-01-30 21:39:51 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:24324: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.28.76
description:
Jan 30 21:40:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.28.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.14.162
description:
2025-01-30 21:40:08 dovecot_login authenticator failed for (ait.edu.gh) [181.117.14.162]:35412: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.28.76
description:
2025-01-30 21:40:09 dovecot_plain authenticator failed for ([120.238.28.76]) [120.238.28.76]:38476: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.188.241
description:
[2025-01-30 21:41:23 +0100] info [webmaild] 45.228.188.241 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.236.23.49
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:21-40.54.236.23.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.5.36.42
description:
[2025-01-30 21:40:34 +0100] info [webmaild] 200.5.36.42 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.6.225.90
description:
2025-01-30 21:42:17 dovecot_login authenticator failed for ([127.0.0.1]) [61.6.225.90]:37706: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.2.151.236
description:
Jan 30 21:42:20 ait sshd[1171781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.2.151.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-01-30 21:42:30 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:38354: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.2.151.236
description:
Jan 30 21:42:20 ait sshd[1171781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.2.151.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.135.148.26
description:
[2025-01-30 21:42:20 +0100] info [webmaild] 190.135.148.26 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.216.249
description:
Jan 30 21:42:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.216.249 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.2.151.236
description:
Jan 30 21:42:22 ait sshd[1171781]: Failed password for invalid user jarservice from 181.2.151.236 port 41478 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.216.249
description:
2025-01-30 21:42:25 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.216.249]:46362: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.225.90
description:
Jan 30 21:42:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.225.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Jan 30 21:42:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.72.89.67
description:
Jan 30 21:42:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.72.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.116.134.124
description:
[2025-01-30 21:43:17 +0100] info [webmaild] 191.116.134.124 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 30 21:42:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.46.20
description:
Jan 30 21:42:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.46.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Jan 30 21:43:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-01-30 21:43:18 dovecot_plain authenticator failed for ([175.156.124.94]) [175.156.124.94]:41577: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.46.20
description:
2025-01-30 21:42:59 dovecot_plain authenticator failed for p285021-obmd01.tokyo.ocn.ne.jp [153.141.46.20]:49298: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
description:
2025-01-30 21:43:14 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:56391: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 21:43:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 21:42:38 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (pailacete) [176.37.212.85]:34357: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.72.89.67
description:
2025-01-30 21:42:49 dovecot_plain authenticator failed for 211-72-89-67.hinet-ip.hinet.net [211.72.89.67]:50996: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.40.138
description:
Jan 30 21:43:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.40.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 21:43:18 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (catrozesis) [51.255.84.180]:60120: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
description:
2025-01-30 21:44:14 dovecot_plain authenticator failed for ([196.46.199.99]) [196.46.199.99]:55258: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
description:
Jan 30 21:44:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.161.111
description:
Jan 30 21:44:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.161.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.96.62.29
description:
Jan 30 21:43:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.96.62.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
description:
2025-01-30 21:43:36 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:42860: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
description:
2025-01-30 21:44:31 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:56001: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Jan 30 21:43:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-01-30 21:43:35 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:33540: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
description:
Jan 30 21:44:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.161.111
description:
2025-01-30 21:44:33 dovecot_plain authenticator failed for (111.161.185.190.cable.dyn.ridsa.com.ar) [190.185.161.111]:42049: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
description:
2025-01-30 21:44:52 dovecot_plain authenticator failed for ([187.72.128.185]) [187.72.128.185]:39404: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
description:
Jan 30 21:44:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.44.115.162
description:
[2025-01-30 21:44:56 +0100] info [webmaild] 110.44.115.162 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.184.155
description:
Jan 30 21:45:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.184.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.184.155
description:
2025-01-30 21:45:06 dovecot_plain authenticator failed for (mail.topkabel.com) [120.197.184.155]:55693: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 30 21:45:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-30 21:45:15 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:42074: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 30 21:45:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
description:
2025-01-30 21:45:58 dovecot_plain authenticator failed for ([121.202.200.120]) [121.202.200.120]:52601: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.95.55.139
description:
[2025-01-30 21:45:46 +0100] info [webmaild] 177.95.55.139 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-30 21:45:46 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:43199: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Jan 30 21:46:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
description:
Jan 30 21:45:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-01-30 21:46:05 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:39714: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-01-30 21:46:20 dovecot_plain authenticator failed for ([95.79.20.9]) [95.79.20.9]:53888: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.186.238.174
description:
[2025-01-30 21:46:28 +0100] info [webmaild] 103.186.238.174 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Jan 30 21:46:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.255.239.223
description:
[2025-01-30 21:47:23 +0100] info [webmaild] 92.255.239.223 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Jan 30 21:47:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.14.162
description:
2025-01-30 21:47:10 dovecot_login authenticator failed for (ait.edu.gh) [181.117.14.162]:46290: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.117.14.162
description:
Jan 30 21:47:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.117.14.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
description:
Jan 30 21:47:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
description:
2025-01-30 21:47:18 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:52199: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.187
description:
Jan 30 21:47:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-01-30 21:47:22 dovecot_plain authenticator failed for (oxespiesom) [65.20.162.187]:48968: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-01-30 21:47:03 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:42326: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
description:
Jan 30 21:47:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-30 21:47:51 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:60324: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
description:
2025-01-30 21:47:53 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:34798: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-30 21:48:27 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:38111: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 30 21:47:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-30 21:47:37 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:42890: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.174
description:
Jan 30 21:48:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
description:
2025-01-30 21:48:07 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:46783: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Jan 30 21:48:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-01-30 21:48:16 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:55463: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 30 21:48:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.68
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:21-47.170.205.31.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 30 21:47:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.234
description:
2025-01-30 21:48:41 dovecot_plain authenticator failed for ([61.185.226.234]) [61.185.226.234]:41749: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
description:
Jan 30 21:48:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Jan 30 21:49:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-30 21:49:21 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:56464: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.233.24
description:
2025-01-30 21:49:24 dovecot_plain authenticator failed for ([175.207.233.24]) [175.207.233.24]:43860: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.65.68
description:
Jan 30 21:48:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.65.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 21:49:06 ait sshd[1174334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-01-30 21:49:10 dovecot_plain authenticator failed for ([60.173.114.254]) [60.173.114.254]:45439: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 30 21:49:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
description:
Jan 30 21:48:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
description:
2025-01-30 21:48:56 dovecot_plain authenticator failed for ([111.53.52.116]) [111.53.52.116]:55124: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.38.203
description:
2025-01-30 21:49:08 dovecot_plain authenticator failed for ([112.27.38.203]) [112.27.38.203]:33719: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.233.24
description:
Jan 30 21:49:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.233.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.120.26.89
description:
2025-01-30 21:49:06 dovecot_login authenticator failed for mm-89-26-120-178.brest.dynamic.pppoe.byfly.by (31094-49731.bacloud.info.) [178.120.26.89]:8049: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 21:49:12 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (dightchak) [176.37.212.85]:42202: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 30 21:49:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.43.204
description:
[2025-01-30 21:49:26 +0100] info [webmaild] 45.171.43.204 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.234
description:
Jan 30 21:48:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Jan 30 21:48:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-01-30 21:48:52 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:50784: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.65.68
description:
2025-01-30 21:48:53 dovecot_plain authenticator failed for ([59.8.65.68]) [59.8.65.68]:55037: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
description:
2025-01-30 21:48:38 dovecot_plain authenticator failed for ([92.124.143.165]) [92.124.143.165]:34684: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.168.113
description:
2025-01-30 21:49:09 dovecot_plain authenticator failed for ([219.145.168.113]) [219.145.168.113]:37885: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.120.26.89
description:
Jan 30 21:49:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.120.26.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Jan 30 21:49:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-01-30 21:49:51 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:51232: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
description:
2025-01-30 21:50:06 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:59144: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Jan 30 21:50:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.6.239.24
description:
[2025-01-30 21:50:29 +0100] info [webmaild] 189.6.239.24 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-30 21:50:28 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:3465: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-01-30 21:50:16 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:41532: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.246.130.88
description:
[2025-01-30 21:50:00 +0100] info [webmaild] 179.246.130.88 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.125.200
description:
Jan 30 21:50:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-30 21:50:46 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:53364: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-01-30 21:50:48 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:31591: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Jan 30 21:50:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
description:
Jan 30 21:50:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 30 21:50:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.140.245.102
description:
[2025-01-30 21:51:26 +0100] info [webmaild] 200.140.245.102 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.187
description:
2025-01-30 21:50:33 dovecot_plain authenticator failed for ([103.146.233.187]) [103.146.233.187]:49054: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-01-30 21:51:00 dovecot_login authenticator failed for ([58.229.51.206]) [58.229.51.206]:50830: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
description:
Jan 30 21:51:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-30 21:51:12 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:12803: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
description:
2025-01-30 21:51:13 dovecot_login authenticator failed for ([200.149.4.102]) [200.149.4.102]:42005: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.187
description:
Jan 30 21:50:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
description:
2025-01-30 21:50:37 dovecot_plain authenticator failed for (187-50-67-114.customer.tdatabrasil.net.br) [187.50.67.114]:57106: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Jan 30 21:50:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 30 21:50:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-30 21:50:48 dovecot_plain authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:14417: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-30 21:51:50 dovecot_plain authenticator failed for (tassive) [178.250.191.189]:59688: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.178
description:
2025-01-30 21:51:59 dovecot_plain authenticator failed for ([197.250.7.67]) [41.220.129.178]:33790: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.73.19.69
description:
Jan 30 21:52:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.73.19.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.19.69
description:
2025-01-30 21:52:16 dovecot_plain authenticator failed for ([154.73.19.69]) [154.73.19.69]:48975: 535 Incorrect authentication data (set_id=assdas1)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-51.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-01-30 21:53:23 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:49398: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 30 21:52:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.184.53.83
description:
Jan 30 21:53:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.184.53.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.184.53.83
description:
2025-01-30 21:53:09 dovecot_login authenticator failed for (default-rdns.vocus.co.nz) [203.184.53.83]:51554: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.51.74.101
description:
[2025-01-30 21:53:11 +0100] info [webmaild] 165.51.74.101 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.68
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:21-52.170.205.31.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.237.145.238
description:
Jan 30 21:53:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.237.145.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 30 21:53:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.145.238
description:
2025-01-30 21:53:09 dovecot_login authenticator failed for ([127.0.0.1]) [171.237.145.238]:40176: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-30 21:52:58 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:63709: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.241.234
description:
2025-01-30 21:52:59 dovecot_login authenticator failed for p54234-obmd01.osaka.ocn.ne.jp ([127.0.0.1]) [153.141.241.234]:53131: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
description:
2025-01-30 21:53:11 dovecot_plain authenticator failed for ([61.177.36.109]) [153.37.177.219]:64394: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.241.234
description:
Jan 30 21:52:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.241.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
description:
Jan 30 21:53:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-30 21:53:09 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (hanting) [94.45.76.149]:46235: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.236.23.49
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:21-54.54.236.23.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Jan 30 21:53:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Jan 30 21:54:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-01-30 21:53:53 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:42702: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
description:
2025-01-30 21:54:04 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:51626: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Jan 30 21:54:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 30 21:53:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.155.146
description:
Jan 30 21:53:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-01-30 21:54:02 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:56470: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
description:
Jan 30 21:54:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
description:
Jan 30 21:54:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.163.141
description:
[2025-01-30 21:54:02 +0100] info [webmaild] 102.219.163.141 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
description:
2025-01-30 21:54:05 dovecot_plain authenticator failed for ([49.207.177.75]) [49.207.177.75]:36086: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 21:53:47 dovecot_plain authenticator failed for ([216.194.174.74]) [216.194.174.27]:15814: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
description:
2025-01-30 21:53:54 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:46769: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Jan 30 21:55:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-01-30 21:55:08 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:48452: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
description:
2025-01-30 21:55:23 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:36864: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.215.132.27
description:
[2025-01-30 21:55:30 +0100] info [webmaild] 179.215.132.27 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.46.76.25
description:
[2025-01-30 21:54:33 +0100] info [webmaild] 95.46.76.25 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-01-30 21:54:49 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:42010: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.116.245.233
description:
Jan 30 21:54:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.116.245.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.116.245.233
description:
2025-01-30 21:55:00 dovecot_plain authenticator failed for ([183.56.179.201]) [113.116.245.233]:1170: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.147.231
description:
2025-01-30 21:55:09 dovecot_login authenticator failed for ([127.0.0.1]) [191.59.147.231]:56712: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.138.244
description:
Jan 30 21:55:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.138.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-01-30 21:54:33 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:40838: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.134.180
description:
Jan 30 21:54:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.134.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.134.180
description:
2025-01-30 21:54:59 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.134.180]:50950: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
description:
Jan 30 21:55:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
description:
Jan 30 21:55:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
description:
2025-01-30 21:55:31 dovecot_plain authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:46376: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.147.231
description:
Jan 30 21:55:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.147.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
description:
2025-01-30 21:55:09 dovecot_plain authenticator failed for ([60.214.127.246]) [60.214.127.246]:31207: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
description:
Jan 30 21:55:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
description:
2025-01-30 21:55:14 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:45290: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Jan 30 21:56:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-01-30 21:56:02 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:45246: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
description:
Jan 30 21:55:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-01-30 21:55:48 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:32774: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
description:
Jan 30 21:56:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Jan 30 21:56:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-01-30 21:56:09 dovecot_plain authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:35885: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-01-30 21:56:11 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:40657: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Jan 30 21:55:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-01-30 21:55:38 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:42032: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.250
description:
Jan 30 21:56:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.250
description:
2025-01-30 21:56:25 dovecot_plain authenticator failed for 111-70-23-250.emome-ip.hinet.net [111.70.23.250]:42629: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.69.46.148
description:
Jan 30 21:57:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.69.46.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.69.46.148
description:
2025-01-30 21:57:11 dovecot_login authenticator failed for ([127.0.0.1]) [202.69.46.148]:35573: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Jan 30 21:57:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-01-30 21:57:21 dovecot_login authenticator failed for ([127.0.0.1]) [203.172.213.166]:58330: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.70.76.28
description:
[2025-01-30 21:57:27 +0100] info [webmaild] 196.70.76.28 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.75.104.218
description:
Jan 30 21:57:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.75.104.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.104.218
description:
2025-01-30 21:57:59 dovecot_plain authenticator failed for ([91.75.104.218]) [91.75.104.218]:34765: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.157.28
description:
[2025-01-30 21:58:02 +0100] info [webmaild] 201.17.157.28 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.26.230
description:
Jan 30 21:57:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.26.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.26.230
description:
2025-01-30 21:57:48 dovecot_plain authenticator failed for 111-70-26-230.emome-ip.hinet.net [111.70.26.230]:42978: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.150.87.70
description:
2025-01-30 21:58:54 dovecot_plain authenticator failed for ([193.150.87.70]) [193.150.87.70]:40392: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-01-30 21:59:19 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:48449: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.134.10.18
description:
Jan 30 21:59:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.134.10.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.134.10.18
description:
2025-01-30 21:59:29 dovecot_plain authenticator failed for (188x134x10x18.static-business.spb.ertelecom.ru) [188.134.10.18]:53094: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.139
description:
2025-01-30 21:59:08 dovecot_plain authenticator failed for 111-70-29-139.emome-ip.hinet.net [111.70.29.139]:55673: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 30 21:59:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-30 21:59:20 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:53084: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.148.86.115
description:
[2025-01-30 21:58:47 +0100] info [webmaild] 186.148.86.115 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.139
description:
Jan 30 21:59:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 30 21:59:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-30 21:59:32 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:37354: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.68
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-58.170.205.31.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Jan 30 21:58:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-01-30 21:58:44 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:45420: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Jan 30 21:59:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.150.87.70
description:
Jan 30 21:58:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.150.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 30 21:59:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-30 21:59:02 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:55895: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Jan 30 22:00:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
description:
Jan 30 21:59:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-30 21:59:49 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:34646: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.255.41.133
description:
2025-01-30 22:00:07 dovecot_login authenticator failed for (ait.edu.gh) [187.255.41.133]:10771: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-30 22:00:13 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:59652: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 30 22:00:24 ait sshd[1178947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.149
description:
2025-01-30 22:00:26 dovecot_plain authenticator failed for ([218.149.170.149]) [218.149.170.149]:58790: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 30 21:59:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
description:
2025-01-30 21:59:37 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:33927: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.244.154.114
description:
[2025-01-30 21:59:40 +0100] info [webmaild] 185.244.154.114 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 30 22:00:24 ait sshd[1178947]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.170.149
description:
Jan 30 22:00:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.170.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-01-30 22:00:30 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:37128: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
description:
2025-01-30 22:00:46 dovecot_plain authenticator failed for ([85.12.240.14]) [85.12.240.14]:48290: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
description:
2025-01-30 22:01:00 dovecot_plain authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:56730: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
description:
2025-01-30 22:00:36 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:34651: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.190.150.4
description:
Jan 30 22:00:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.190.150.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:00:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
description:
2025-01-30 22:00:39 dovecot_plain authenticator failed for ([203.190.150.4]) [203.190.150.4]:39648: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.10
description:
Jan 30 22:00:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Jan 30 22:00:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
description:
Jan 30 22:00:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.10
description:
2025-01-30 22:00:45 dovecot_plain authenticator failed for ([103.106.154.10]) [103.106.154.10]:37680: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.241.15
description:
Jan 30 22:00:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.241.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.211.106
description:
[2025-01-30 22:01:20 +0100] info [webmaild] 191.243.211.106 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
description:
Jan 30 22:00:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-01-30 22:00:51 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:5482: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Jan 30 22:02:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-01-30 22:02:02 dovecot_plain authenticator failed for (k6447ipjpocv034o) [77.40.62.195]:6634: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.141.141
description:
[2025-01-30 22:02:10 +0100] info [webmaild] 5.62.141.141 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 38.242.220.164
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:22-01.38.242.220.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 30 22:03:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.160.76
description:
Jan 30 22:02:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.160.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
description:
2025-01-30 22:02:54 dovecot_plain authenticator failed for ([103.250.160.76]) [103.250.160.76]:41928: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.61.210.39
description:
[2025-01-30 22:02:42 +0100] info [webmaild] 181.61.210.39 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-30 22:03:15 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (apack) [109.67.154.24]:44832: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Jan 30 22:02:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-01-30 22:02:37 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:45640: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.2.204.44
description:
[2025-01-30 22:03:37 +0100] info [webmaild] 84.2.204.44 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.226.214
description:
Jan 30 22:03:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.4.105
description:
Jan 30 22:04:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.4.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
description:
2025-01-30 22:04:02 dovecot_plain authenticator failed for ([182.176.4.105]) [182.176.4.105]:55342: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 30 22:04:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-30 22:04:15 dovecot_plain authenticator failed for ([175.180.129.87]) [175.180.129.87]:58840: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.102.188.188
description:
Jan 30 22:04:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.102.188.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-01-30 22:03:35 dovecot_plain authenticator failed for ([175.156.125.94]) [175.156.125.94]:46557: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:04:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Jan 30 22:04:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-04.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.226.214
description:
2025-01-30 22:03:47 dovecot_plain authenticator failed for ([75.110.226.214]) [75.110.226.214]:45204: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.102.188.188
description:
2025-01-30 22:04:20 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:38351: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Jan 30 22:03:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-01-30 22:04:30 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:58415: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
description:
Jan 30 22:04:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.65.20
description:
Jan 30 22:04:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.65.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.65.20
description:
2025-01-30 22:04:48 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.65.20]:39523: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.134
description:
2025-01-30 22:04:34 dovecot_plain authenticator failed for ([119.62.184.134]) [119.62.184.134]:55743: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.149
description:
Jan 30 22:04:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 30 22:05:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.9.44.198
description:
[2025-01-30 22:05:17 +0100] info [webmaild] 185.9.44.198 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.72.97.147
description:
Jan 30 22:05:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.72.97.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.134
description:
Jan 30 22:04:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-30 22:05:05 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:37804: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-01-30 22:05:18 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:45849: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.72.97.147
description:
2025-01-30 22:05:30 dovecot_login authenticator failed for vmi2383186.contaboserver.net ([127.0.0.1]) [94.72.97.147]:37010: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
description:
2025-01-30 22:04:38 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:58165: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
description:
2025-01-30 22:05:04 dovecot_login authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:42438: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Jan 30 22:05:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
description:
Jan 30 22:04:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
description:
2025-01-30 22:04:41 dovecot_login authenticator failed for ([127.0.0.1]) [121.44.217.237]:40437: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.149
description:
2025-01-30 22:04:54 dovecot_login authenticator failed for ([218.149.228.149]) [218.149.228.149]:59321: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.122.40
description:
Jan 30 22:05:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.122.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Jan 30 22:05:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.33.36.254
description:
Jan 30 22:05:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.33.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-01-30 22:05:29 dovecot_plain authenticator failed for ([90.189.180.243]) [90.189.180.243]:49014: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.122.40
description:
2025-01-30 22:05:30 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.122.40]:47228: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-30 22:06:26 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:47822: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Jan 30 22:05:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.180.46.58
description:
2025-01-30 22:05:44 dovecot_login authenticator failed for ([127.0.0.1]) [113.180.46.58]:37868: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.72.12
description:
Jan 30 22:05:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.72.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-01-30 22:06:11 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:55378: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
description:
Jan 30 22:06:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 30 22:06:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.203.43
description:
Jan 30 22:05:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.203.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-30 22:06:06 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:51699: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
description:
Jan 30 22:05:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.58.173
description:
Jan 30 22:05:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.58.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
description:
2025-01-30 22:05:46 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (unestsm) [80.14.31.158]:37982: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.72.12
description:
2025-01-30 22:05:54 dovecot_plain authenticator failed for ([120.236.72.12]) [120.236.72.12]:40420: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Jan 30 22:06:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-01-30 22:05:39 dovecot_login authenticator failed for ([127.0.0.1]) [161.35.200.202]:56374: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
description:
2025-01-30 22:05:40 dovecot_plain authenticator failed for ([220.172.203.43]) [220.172.203.43]:60763: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.244.53.248
description:
[2025-01-30 22:06:07 +0100] info [webmaild] 94.244.53.248 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Jan 30 22:06:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
description:
2025-01-30 22:06:21 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:60525: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.33.36.254
description:
2025-01-30 22:05:31 dovecot_plain authenticator failed for ([102.33.36.254]) [102.33.36.254]:45038: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.180.46.58
description:
Jan 30 22:05:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.180.46.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.58.173
description:
2025-01-30 22:05:47 dovecot_login authenticator failed for ([127.0.0.1]) [192.199.58.173]:42094: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-01-30 22:06:40 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:55067: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.193.19.51
description:
[2025-01-30 22:06:58 +0100] info [webmaild] 186.193.19.51 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.230.127.224
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-07.213.230.127.224


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Jan 30 22:06:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-30 22:07:09 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:53524: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 30 22:07:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.154.53.221
description:
2025-01-30 22:08:39 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:27198: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.54.87
description:
2025-01-30 22:08:59 dovecot_plain authenticator failed for ([120.237.54.87]) [120.237.54.87]:36203: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 22:09:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Jan 30 22:09:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Jan 30 22:09:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
description:
Jan 30 22:08:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.119
description:
2025-01-30 22:08:34 dovecot_login authenticator failed for (ADMIN) [181.215.182.119]:60852: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.40.12.109
description:
[2025-01-30 22:09:15 +0100] info [webmaild] 177.40.12.109 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
description:
2025-01-30 22:09:19 dovecot_plain authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:41523: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-01-30 22:09:27 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:49898: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
description:
2025-01-30 22:08:34 dovecot_plain authenticator failed for ([23.94.85.164]) [23.94.85.164]:36316: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-01-30 22:09:14 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:58994: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.176.19.171
description:
[2025-01-30 22:10:04 +0100] info [webmaild] 103.176.19.171 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.26.115.238
description:
Jan 30 22:10:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.26.115.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.29.20.52
description:
2025-01-30 22:10:19 dovecot_login authenticator failed for host-92-29-20-52.as13285.net [92.29.20.52]:60057: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-30 22:10:29 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:44930: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 82.223.15.36
domain: aitedu.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.bak||User:titlemas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
description:
2025-01-30 22:10:18 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:53477: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.238
description:
2025-01-30 22:10:19 dovecot_plain authenticator failed for ([193.26.115.238]) [193.26.115.238]:59407: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
description:
2025-01-30 22:10:46 dovecot_plain authenticator failed for ([178.178.194.203]) [178.178.194.203]:50950: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.12.36
description:
2025-01-30 22:11:13 dovecot_plain authenticator failed for ([210.21.12.36]) [210.21.12.36]:59319: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-01-30 22:11:27 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:28287: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
description:
2025-01-30 22:10:32 dovecot_plain authenticator failed for ([60.172.41.103]) [60.172.41.103]:37650: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-01-30 22:10:36 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:48916: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.255.20.15
description:
[2025-01-30 22:10:47 +0100] info [webmaild] 38.255.20.15 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-01-30 22:12:01 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:34144: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-30 22:12:12 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:47931: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-01-30 22:12:20 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:41861: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.100.208.56
description:
2025-01-30 22:12:24 dovecot_login authenticator failed for 79-100-208-56.ip.btc-net.bg (ait.edu.gh) [79.100.208.56]:3859: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.49.208.161
description:
[2025-01-30 22:11:41 +0100] info [webmaild] 187.49.208.161 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.112.193
description:
Jan 30 22:12:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.112.193
description:
2025-01-30 22:12:06 dovecot_plain authenticator failed for 131.108.112.193.pontonetassai.com.br [131.108.112.193]:33178: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
description:
Jan 30 22:12:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
description:
2025-01-30 22:12:29 dovecot_login authenticator failed for a109-51-222-234.cpe.netcabo.pt ([127.0.0.1]) [109.51.222.234]:34828: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-01-30 22:13:17 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:45338: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 22:13:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.13
description:
Jan 30 22:12:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.216.135.13
description:
2025-01-30 22:12:37 dovecot_login authenticator failed for ([127.0.0.1]) [103.216.135.13]:47416: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
description:
2025-01-30 22:12:37 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:48216: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-30 22:12:38 dovecot_plain authenticator failed for (villee) [102.53.15.54]:60998: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.154.53.221
description:
2025-01-30 22:13:03 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:53587: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.159.214.69
description:
[2025-01-30 22:13:16 +0100] info [webmaild] 105.159.214.69 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.201.167
description:
[2025-01-30 22:14:01 +0100] info [webmaild] 181.78.201.167 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 22:14:04 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (morastric) [51.255.84.180]:44044: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-30 22:13:49 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:37820: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.20.180
description:
Jan 30 22:14:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.20.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.20.180
description:
2025-01-30 22:14:19 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:58072: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-01-30 22:14:25 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:54642: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-01-30 22:13:34 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:57677: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
description:
2025-01-30 22:14:27 dovecot_login authenticator failed for ([112.31.93.182]) [112.31.93.182]:54664: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-30 22:13:58 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:43780: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Jan 30 22:14:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-30 22:14:01 dovecot_plain authenticator failed for ([185.123.78.13]) [185.123.78.13]:48822: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 22:14:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 22:15:11 ait sshd[1185792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-30 22:15:23 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:55928: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Jan 30 22:14:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.137.236.105
description:
[2025-01-30 22:14:42 +0100] info [webmaild] 38.137.236.105 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-01-30 22:14:54 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:22615: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
description:
2025-01-30 22:14:38 dovecot_login authenticator failed for ([116.10.127.167]) [116.10.127.167]:33601: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
description:
2025-01-30 22:14:40 dovecot_plain authenticator failed for ([222.67.186.253]) [222.67.186.253]:45286: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-30 22:15:01 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:46918: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-01-30 22:14:38 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:49560: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Jan 30 22:14:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-30 22:15:20 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:55722: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
description:
Jan 30 22:14:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.227.235
description:
2025-01-30 22:14:55 H=(mail.aitsmartschool.com) [165.154.227.235]:62399 F=<evwixmf@aitsmartschool.com> rejected RCPT <validxxxg@gmail.com>: Rejected relay attempt: '165.154.227.235' From: 'evwixmf@aitsmartschool.com' To: 'validxxxg@gmail.com'


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 22:15:11 ait sshd[1185792]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Jan 30 22:16:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-01-30 22:16:21 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:54900: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-01-30 22:16:09 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:41723: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
description:
Jan 30 22:16:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.115.62
description:
[2025-01-30 22:15:35 +0100] info [webmaild] 170.239.115.62 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-01-30 22:16:02 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:43728: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-30 22:15:43 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:57795: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-30 22:15:52 dovecot_plain authenticator failed for ([94.43.224.106]) [2.57.219.2]:49870: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-17.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-01-30 22:17:20 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:58562: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.67.67.160
description:
[2025-01-30 22:17:28 +0100] info [webmaild] 181.67.67.160 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 22:16:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-16.104.209.253.237


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 208.113.236.250
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-17.208.113.236.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-01-30 22:16:35 dovecot_plain authenticator failed for ([31.0.8.92]) [31.0.8.92]:59186: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-30 22:16:47 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:40495: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.87.122
description:
2025-01-30 22:17:53 dovecot_plain authenticator failed for ([2.54.87.122]) [2.54.87.122]:41575: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 30 22:18:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-30 22:18:22 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:50748: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.254.162
description:
2025-01-30 22:17:59 dovecot_plain authenticator failed for ([223.71.254.162]) [223.71.254.162]:54385: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.70.126
description:
2025-01-30 22:18:11 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.70.126]:52860: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.189.173.223
description:
[2025-01-30 22:18:12 +0100] info [webmaild] 187.189.173.223 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.6.225.90
description:
2025-01-30 22:18:20 dovecot_login authenticator failed for ([127.0.0.1]) [61.6.225.90]:33147: 535 Incorrect authentication data (set_id=laryea)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-17.157.230.172.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.54.70.126
description:
Jan 30 22:18:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.54.70.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-30 22:18:13 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:46372: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.225.90
description:
Jan 30 22:18:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.225.90 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.153
description:
47.128.54.153 - - [30/Jan/2025:22:19:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9523120 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=102&format=pdf&id=47%3Amission-statement&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
description:
2025-01-30 22:19:07 dovecot_login authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:43775: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
description:
Jan 30 22:19:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
description:
2025-01-30 22:19:21 dovecot_login authenticator failed for ([127.0.0.1]) [183.123.27.87]:58574: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Jan 30 22:19:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 22:19:30 dovecot_plain authenticator failed for (opianizes) [207.188.157.230]:6881: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-01-30 22:18:57 dovecot_login authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:56804: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.244.81.59
description:
[2025-01-30 22:18:59 +0100] info [webmaild] 152.244.81.59 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-01-30 22:19:32 dovecot_login authenticator failed for ([127.0.0.1]) [27.223.100.90]:36206: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.50.14
description:
2025-01-30 22:20:00 dovecot_plain authenticator failed for (ip-177-25-34-169.user.vivozap.com.br) [187.92.50.14]:51815: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.173.218
description:
[2025-01-30 22:19:55 +0100] info [webmaild] 191.243.173.218 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-01-30 22:20:23 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:38936: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
description:
2025-01-30 22:19:48 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:58987: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 22:19:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.149.148.68
description:
[2025-01-30 22:19:53 +0100] info [webmaild] 178.149.148.68 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.6.31
description:
2025-01-30 22:21:20 dovecot_login authenticator failed for ([127.0.0.1]) [178.71.6.31]:48686: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.73.86
description:
Jan 30 22:21:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.73.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.73.86
description:
2025-01-30 22:21:31 dovecot_login authenticator failed for ([127.0.0.1]) [95.52.73.86]:58874: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-30 22:20:36 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:40186: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.71.6.31
description:
Jan 30 22:21:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.71.6.31 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.154.185.3
description:
[2025-01-30 22:21:42 +0100] info [webmaild] 78.154.185.3 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-01-30 22:22:08 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:55144: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
description:
2025-01-30 22:21:56 dovecot_plain authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:43354: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Jan 30 22:22:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 30 22:22:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-30 22:22:15 dovecot_plain authenticator failed for (perse) [62.231.31.86]:57603: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.135.194.249
description:
[2025-01-30 22:22:32 +0100] info [webmaild] 179.135.194.249 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
description:
Jan 30 22:23:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Jan 30 22:23:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-01-30 22:23:22 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:50755: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 22:23:24 ait sshd[1189152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-01-30 22:22:51 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:42051: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-30 22:23:01 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:54166: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.170.96.168
description:
[2025-01-30 22:23:03 +0100] info [webmaild] 177.170.96.168 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-30 22:23:05 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:54181: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-01-30 22:22:41 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:58119: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 30 22:23:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-01-30 22:23:15 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:47512: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
description:
2025-01-30 22:23:27 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:49693: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
description:
2025-01-30 22:23:14 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:42977: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
description:
Jan 30 22:23:24 ait sshd[1189152]: Invalid user universitypublishing from 211.108.234.111 port 32784


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 22:23:24 ait sshd[1189152]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-01-30 22:23:44 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:61024: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.197.102
description:
Jan 30 22:24:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.197.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:23:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 216.10.214.148
description:
[2025-01-30 22:23:56 +0100] info [webmaild] 216.10.214.148 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.197.102
description:
2025-01-30 22:24:27 dovecot_plain authenticator failed for (lomored) [65.20.197.102]:36726: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.84.220
description:
2025-01-30 22:23:33 dovecot_plain authenticator failed for ([175.210.84.220]) [175.210.84.220]:40382: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 30 22:23:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-30 22:23:47 dovecot_plain authenticator failed for (batly) [62.231.31.86]:35309: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-30 22:24:59 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:60098: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.83.38.15
description:
2025-01-30 22:25:09 dovecot_plain authenticator failed for (50-83-38-15.client.mchsi.com) [50.83.38.15]:59078: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 30 22:25:30 ait sshd[1190129]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 30 22:25:30 ait sshd[1190129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 22:24:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-01-30 22:26:19 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:43880: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-01-30 22:25:35 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:34762: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Jan 30 22:26:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.20.9
description:
[2025-01-30 22:25:55 +0100] info [webmaild] 45.170.20.9 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.91.144
description:
2025-01-30 22:25:59 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:55061: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 30 22:25:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-01-30 22:25:44 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:42394: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-30 22:26:08 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:56607: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-01-30 22:26:19 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:30106: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-30 22:26:24 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:41996: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-30 22:25:52 dovecot_plain authenticator failed for ([138.75.98.134]) [138.75.98.134]:54370: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-30 22:26:00 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:52030: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Jan 30 22:26:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.241.4.109
description:
[2025-01-30 22:26:42 +0100] info [webmaild] 212.241.4.109 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.81
description:
2025-01-30 22:26:35 dovecot_login authenticator failed for ([121.11.145.81]) [121.11.145.81]:55818: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-01-30 22:26:44 dovecot_login authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:32055: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.238.228
description:
[2025-01-30 22:27:04 +0100] info [webmaild] 138.219.238.228 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.106
description:
47.128.22.106 - - [30/Jan/2025:22:27:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12963700 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?option=com_content&view=article&id=60&Itemid=75" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-01-30 22:27:20 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:62006: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-01-30 22:27:23 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:53885: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-01-30 22:28:21 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:41130: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Jan 30 22:28:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.138.162
description:
2025-01-30 22:28:28 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:42948: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:27:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
description:
2025-01-30 22:27:38 dovecot_plain authenticator failed for ([58.34.174.90]) [58.34.174.90]:47488: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-30 22:28:02 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:57868: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.73.86
description:
Jan 30 22:27:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.73.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-01-30 22:27:47 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:47018: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-30 22:28:32 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:57516: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 22:27:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.73.86
description:
2025-01-30 22:27:49 dovecot_login authenticator failed for ([127.0.0.1]) [95.52.73.86]:24925: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.214.69.165
description:
[2025-01-30 22:27:59 +0100] info [webmaild] 179.214.69.165 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.125.140
description:
Jan 30 22:28:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.39.125.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.39.125.140
description:
2025-01-30 22:28:09 dovecot_login authenticator failed for ip140.ip-54-39-125.net ([127.0.0.1]) [54.39.125.140]:46686: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
description:
2025-01-30 22:29:11 dovecot_plain authenticator failed for ([166.195.196.240]) [166.195.196.240]:39957: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-29.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-01-30 22:29:26 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:53956: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 22:28:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-01-30 22:28:38 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:58532: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
description:
2025-01-30 22:28:45 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:44714: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
description:
Jan 30 22:29:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-30 22:29:21 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:55610: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-01-30 22:29:51 dovecot_plain authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:54612: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.98.189
description:
[2025-01-30 22:29:48 +0100] info [webmaild] 45.71.98.189 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
description:
2025-01-30 22:29:38 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:49945: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.173
description:
2025-01-30 22:30:04 dovecot_plain authenticator failed for ([112.28.128.173]) [112.28.128.173]:36802: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 30 22:30:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-30 22:30:27 dovecot_plain authenticator failed for (discous) [93.159.152.6]:44118: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.173.126.25
description:
[2025-01-30 22:31:04 +0100] info [webmaild] 85.173.126.25 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.54.67
description:
[2025-01-30 22:30:37 +0100] info [webmaild] 177.55.54.67 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-01-30 22:30:47 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:56770: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.159.140
description:
2025-01-30 22:31:01 dovecot_plain authenticator failed for (abts-north-dynamic-140.159.176.122.airtelbroadband.in) [122.176.159.140]:57801: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-01-30 22:31:30 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:34672: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Jan 30 22:31:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Jan 30 22:30:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.159.140
description:
Jan 30 22:30:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.159.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.19.94
description:
Jan 30 22:31:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.19.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Jan 30 22:32:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.204.233.3
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:22-32.15.204.233.3


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-01-30 22:32:08 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:33422: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Jan 30 22:31:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.193.41.66
description:
2025-01-30 22:31:55 dovecot_plain authenticator failed for ([141.193.41.66]) [141.193.41.66]:50415: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.162.30.3
description:
Jan 30 22:32:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.162.30.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.38.5
description:
2025-01-30 22:31:48 dovecot_plain authenticator failed for ([211.169.38.5]) [211.169.38.5]:44540: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.174
description:
Jan 30 22:31:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.174 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.201.190.156
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-31.195.201.190.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.38.5
description:
Jan 30 22:31:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.38.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-01-30 22:31:51 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:44520: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.30.3
description:
2025-01-30 22:32:27 dovecot_plain authenticator failed for ([121.162.30.3]) [121.162.30.3]:50655: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
description:
2025-01-30 22:31:55 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:35633: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 30 22:32:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-01-30 22:31:57 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:39079: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-01-30 22:32:05 dovecot_plain authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:38740: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
description:
2025-01-30 22:32:16 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:54051: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 30 22:31:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.19.94
description:
2025-01-30 22:31:41 dovecot_plain authenticator failed for ([187.50.19.94]) [187.50.19.94]:59815: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Jan 30 22:31:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.193.41.66
description:
Jan 30 22:31:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.193.41.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 30 22:32:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-30 22:32:23 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:52064: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.4.159
description:
[2025-01-30 22:31:58 +0100] info [webmaild] 37.238.4.159 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-30 22:32:02 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:48725: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 125.212.214.104
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-32.125.212.214.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
description:
Jan 30 22:32:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-30 22:31:44 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:36847: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
description:
Jan 30 22:32:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
description:
2025-01-30 22:32:19 dovecot_plain authenticator failed for ([65.76.106.187]) [65.76.106.187]:54006: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
description:
Jan 30 22:32:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-30 22:32:38 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:33188: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 30 22:32:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 22:32:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 30 22:33:16 ait sshd[1193800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 30 22:32:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 30 22:32:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 30 22:32:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-30 22:32:46 dovecot_plain authenticator failed for ([91.116.42.218]) [91.116.42.218]:37678: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
description:
Jan 30 22:32:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
description:
2025-01-30 22:32:36 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:40518: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-30 22:32:41 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:9559: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-30 22:32:42 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:43412: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 30 22:33:16 ait sshd[1193800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
description:
Jan 30 22:33:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
description:
Jan 30 22:33:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
description:
2025-01-30 22:33:56 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:47595: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-01-30 22:34:09 dovecot_plain authenticator failed for (avoid) [62.74.225.186]:55715: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 30 22:34:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-01-30 22:34:15 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:33778: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
description:
2025-01-30 22:33:44 dovecot_plain authenticator failed for ([60.14.36.47]) [60.14.36.47]:37020: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 22:33:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Jan 30 22:34:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-30 22:34:28 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:46481: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 22:33:47 ait sshd[1193919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 22:33:47 ait sshd[1193919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.181.138.46
description:
[2025-01-30 22:33:48 +0100] info [webmaild] 190.181.138.46 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 30 22:34:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.132.99.176
description:
[2025-01-30 22:34:38 +0100] info [webmaild] 2.132.99.176 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
description:
2025-01-30 22:35:04 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:53543: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 30 22:34:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 30 22:34:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-30 22:34:49 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:54255: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-30 22:34:51 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:43731: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Jan 30 22:35:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-01-30 22:35:01 dovecot_plain authenticator failed for ([200.125.14.122]) [200.125.14.122]:33078: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.239.147.162
description:
[2025-01-30 22:34:57 +0100] info [webmaild] 45.239.147.162 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
description:
Jan 30 22:34:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-30 22:35:31 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:48236: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.124.123.93
description:
[2025-01-30 22:35:46 +0100] info [webmaild] 189.124.123.93 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
description:
2025-01-30 22:35:54 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:44256: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-30 22:35:55 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:63764: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
description:
2025-01-30 22:36:15 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:60800: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
description:
Jan 30 22:35:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 30 22:35:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
description:
Jan 30 22:36:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 22:37:18 ait sshd[1195385]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 22:37:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-30 22:36:37 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:40136: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.101.197.90
description:
2025-01-30 22:36:40 dovecot_plain authenticator failed for (ait.edu.gh) [177.101.197.90]:43599: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
description:
Jan 30 22:36:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
description:
2025-01-30 22:36:51 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:33562: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 22:37:18 ait sshd[1195385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 22:37:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 22:37:26 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (coellindis) [51.255.84.180]:53518: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 30 22:36:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
description:
Jan 30 22:37:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
description:
2025-01-30 22:37:40 dovecot_plain authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:61257: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 30 22:37:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-30 22:37:57 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:51106: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.105.61.23
description:
2025-01-30 22:38:20 dovecot_plain authenticator failed for ([62.105.61.23]) [62.105.61.23]:41279: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.7.135.13
description:
Jan 30 22:38:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.7.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.47
description:
2025-01-30 22:37:51 dovecot_login authenticator failed for (ADMIN) [216.24.213.47]:57800: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.105.61.23
description:
Jan 30 22:38:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.105.61.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 22:38:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.170.106
description:
[2025-01-30 22:37:44 +0100] info [webmaild] 138.186.170.106 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.47.141.222
description:
[2025-01-30 22:38:33 +0100] info [webmaild] 177.47.141.222 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.216.125
description:
2025-01-30 22:38:42 dovecot_plain authenticator failed for ([196.46.216.125]) [196.46.216.125]:45242: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-01-30 22:38:58 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:57616: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.216.125
description:
Jan 30 22:38:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.216.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.216.189.40
description:
[2025-01-30 22:38:51 +0100] info [webmaild] 189.216.189.40 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Jan 30 22:38:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
description:
Jan 30 22:39:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
description:
Jan 30 22:39:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
description:
2025-01-30 22:39:17 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:51817: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.176.182
description:
Jan 30 22:39:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.176.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.176.182
description:
2025-01-30 22:39:29 dovecot_login authenticator failed for ([127.0.0.1]) [180.7.176.182]:47907: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.7.135.13
description:
2025-01-30 22:38:31 dovecot_plain authenticator failed for ([119.7.135.13]) [119.7.135.13]:41443: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
description:
2025-01-30 22:39:07 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:59349: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:39:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 22:40:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.171.66.147
description:
2025-01-30 22:39:42 dovecot_login authenticator failed for ([127.0.0.1]) [61.171.66.147]:39176: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.109.102.27
description:
[2025-01-30 22:39:45 +0100] info [webmaild] 179.109.102.27 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 22:40:12 ait sshd[1196675]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 22:40:12 ait sshd[1196675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 30 22:40:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.171.66.147
description:
Jan 30 22:39:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.171.66.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-30 22:40:26 dovecot_plain authenticator failed for ([140.246.50.122]) [203.34.57.78]:44040: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
description:
2025-01-30 22:41:19 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:57548: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
description:
Jan 30 22:41:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
description:
2025-01-30 22:41:27 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:52232: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
description:
Jan 30 22:41:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.102
description:
Jan 30 22:40:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 22:41:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.102
description:
2025-01-30 22:40:40 dovecot_plain authenticator failed for ([102.69.163.102]) [102.69.163.102]:59168: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 30 22:40:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-30 22:41:01 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:56292: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
description:
Jan 30 22:41:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
description:
2025-01-30 22:41:26 dovecot_plain authenticator failed for (theaulph) [65.20.253.152]:50687: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Jan 30 22:41:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-01-30 22:41:38 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:39104: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.222.110.228
description:
[2025-01-30 22:42:31 +0100] info [webmaild] 38.222.110.228 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
description:
2025-01-30 22:42:13 dovecot_plain authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:38704: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
description:
2025-01-30 22:42:30 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:54961: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-42.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.209.44.9
description:
Jan 30 22:42:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.209.44.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
description:
Jan 30 22:42:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
description:
2025-01-30 22:42:24 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:53985: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
description:
Jan 30 22:42:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.33.66.62
description:
[2025-01-30 22:41:41 +0100] info [webmaild] 189.33.66.62 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.124.196.142
description:
[2025-01-30 22:42:42 +0100] info [webmaild] 179.124.196.142 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.133.87
description:
2025-01-30 22:42:47 dovecot_plain authenticator failed for (223-197-133-87.static.imsbiz.com) [223.197.133.87]:52340: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Jan 30 22:42:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 30 22:43:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Jan 30 22:42:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 30 22:43:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-30 22:43:23 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:51786: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.133.87
description:
Jan 30 22:42:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.133.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-01-30 22:42:55 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:43248: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-01-30 22:42:57 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:36914: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 22:43:13 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2501: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.132.4.121
description:
[2025-01-30 22:43:34 +0100] info [webmaild] 190.132.4.121 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.166.200
description:
Jan 30 22:44:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.166.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.166.200
description:
2025-01-30 22:44:26 dovecot_plain authenticator failed for ([183.233.166.200]) [183.233.166.200]:47698: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.196.192.246
description:
Jan 30 22:44:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.196.192.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.196.192.246
description:
Jan 30 22:44:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.196.192.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 30 22:44:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
description:
Jan 30 22:44:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
description:
2025-01-30 22:45:04 dovecot_plain authenticator failed for ([220.180.107.193]) [220.180.107.193]:54901: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.196.192.246
description:
2025-01-30 22:44:32 dovecot_login authenticator failed for (31094-49731.bacloud.info.) [46.196.192.246]:14736: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-30 22:44:42 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:40279: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
description:
2025-01-30 22:44:43 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:34398: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.107.193
description:
Jan 30 22:45:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.107.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.25.156.174
description:
[2025-01-30 22:45:39 +0100] info [webmaild] 5.25.156.174 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 22:46:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Jan 30 22:46:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
description:
Jan 30 22:46:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 22:45:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-01-30 22:46:20 dovecot_plain authenticator failed for ([58.33.109.90]) [58.33.109.90]:46207: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Jan 30 22:46:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 22:46:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-01-30 22:46:27 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:58476: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.26.205
description:
[2025-01-30 22:46:28 +0100] info [webmaild] 179.108.26.205 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Jan 30 22:47:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Jan 30 22:47:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 30 22:47:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 22:46:32 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (aselableus) [51.255.84.180]:60014: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-01-30 22:46:35 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:59940: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 30 22:46:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 30 22:46:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Jan 30 22:46:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
description:
Jan 30 22:47:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-01-30 22:46:43 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:55452: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-01-30 22:46:49 dovecot_login authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:53012: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.230
description:
Jan 30 22:46:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.230 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.171.226.133
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:fusheini@ait.edu.gh||WPU:fusheini@ait.edu.gh||RSV:6.65||T:APACHE||MV:22-47.83.171.226.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-01-30 22:47:16 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:64951: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Jan 30 22:47:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-30 22:47:10 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:46541: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-30 22:47:28 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:50168: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-01-30 22:46:32 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:50434: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Jan 30 22:46:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.55.50
description:
[2025-01-30 22:46:39 +0100] info [webmaild] 191.242.55.50 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Jan 30 22:46:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-01-30 22:47:07 dovecot_login authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:33938: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Jan 30 22:46:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-30 22:46:48 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:35900: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.230
description:
2025-01-30 22:46:56 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.230]:39124: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
description:
2025-01-30 22:47:20 dovecot_login authenticator failed for ([130.185.96.125]) [130.185.96.125]:38894: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
description:
Jan 30 22:48:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
description:
2025-01-30 22:48:21 dovecot_login authenticator failed for ([58.18.64.54]) [58.18.64.54]:35589: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-01-30 22:47:34 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:40402: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-30 22:47:50 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:49948: 535 Incorrect authentication data (set_id=ads16a00084y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-01-30 22:47:59 dovecot_login authenticator failed for ([77.87.103.131]) [77.87.103.131]:56250: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.148.130.25
description:
2025-01-30 22:48:00 dovecot_login authenticator failed for ([197.148.130.25]) [197.148.130.25]:43078: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 30 22:47:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
description:
2025-01-30 22:47:58 dovecot_login authenticator failed for ([107.150.100.139]) [107.150.100.139]:39388: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
description:
2025-01-30 22:48:08 dovecot_plain authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:38874: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.253.18.251
description:
2025-01-30 22:48:02 dovecot_login authenticator failed for ([120.253.18.251]) [120.253.18.251]:34926: 535 Incorrect authentication data (set_id=ads16a00084y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Jan 30 22:48:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
description:
2025-01-30 22:47:36 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:38296: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 30 22:47:37 ait sshd[1199804]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-01-30 22:47:47 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:54050: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Jan 30 22:47:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
description:
Jan 30 22:48:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-30 22:47:42 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:49152: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.148.130.25
description:
Jan 30 22:47:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.148.130.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.253.18.251
description:
Jan 30 22:48:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.253.18.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 30 22:47:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
description:
Jan 30 22:47:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
description:
Jan 30 22:47:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-01-30 22:48:22 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:65198: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.143.223
description:
[2025-01-30 22:47:32 +0100] info [webmaild] 5.62.143.223 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
description:
Jan 30 22:47:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 30 22:47:37 ait sshd[1199804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Jan 30 22:47:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.136.193.248
description:
Jan 30 22:48:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.136.193.248 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.189.98.172
description:
Jan 30 22:48:38 ait sshd[1200179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.189.98.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.193.248
description:
2025-01-30 22:48:40 dovecot_login authenticator failed for (248-193-136-45.ddns.movitel.tv) [45.136.193.248]:58818: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
description:
Jan 30 22:48:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-01-30 22:48:51 dovecot_login authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:37019: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.137.82.50
description:
Jan 30 22:49:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.137.82.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.98.81
description:
Jan 30 22:49:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.122.98.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
description:
2025-01-30 22:50:08 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:46635: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-30 22:50:15 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com (caponed) [131.106.85.205]:60454: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 30 22:50:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.46.16.125
description:
[2025-01-30 22:49:38 +0100] info [webmaild] 186.46.16.125 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.137.82.50
description:
2025-01-30 22:49:38 dovecot_login authenticator failed for ([121.137.82.50]) [121.137.82.50]:36810: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-30 22:49:40 dovecot_plain authenticator failed for (supenstone) [109.160.123.6]:53456: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
description:
2025-01-30 22:49:51 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:45303: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.196.133
description:
Jan 30 22:49:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.196.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.196.133
description:
2025-01-30 22:49:59 dovecot_login authenticator failed for ([121.188.196.133]) [121.188.196.133]:39838: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-30 22:50:23 dovecot_plain authenticator failed for ([89.211.42.163]) [37.186.40.110]:38628: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Jan 30 22:50:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.228.190.124
description:
Jan 30 22:49:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.228.190.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
description:
2025-01-30 22:49:40 dovecot_plain authenticator failed for 45-228-190-124.obercom.net.ar [45.228.190.124]:57977: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.98.81
description:
2025-01-30 22:49:56 dovecot_plain authenticator failed for ([222.122.98.81]) [222.122.98.81]:60738: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
description:
Jan 30 22:50:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 30 22:50:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.249.59.5
description:
[2025-01-30 22:50:27 +0100] info [webmaild] 191.249.59.5 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 30 22:49:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
description:
Jan 30 22:49:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
description:
[2025-01-30 22:51:04 +0100] info [whostmgrd] 147.45.44.84 - ddessel@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 22:51:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
description:
2025-01-30 22:51:13 dovecot_login authenticator failed for ([221.13.67.132]) [221.13.67.132]:43625: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-01-30 22:50:33 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:60671: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.20.214.234
description:
[2025-01-30 22:50:44 +0100] info [webmaild] 94.20.214.234 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
description:
Jan 30 22:50:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
description:
2025-01-30 22:50:59 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:57626: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
description:
Jan 30 22:51:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.150.236.203
description:
Jan 30 22:51:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.150.236.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.150.236.203
description:
2025-01-30 22:51:54 dovecot_plain authenticator failed for ([62.150.236.203]) [62.150.236.203]:58368: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
description:
Jan 30 22:52:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
description:
Jan 30 22:52:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
description:
Jan 30 22:52:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
description:
2025-01-30 22:52:27 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:55997: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.211.59.176
description:
[2025-01-30 22:51:40 +0100] info [webmaild] 197.211.59.176 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Jan 30 22:52:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-01-30 22:52:04 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:53592: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
description:
2025-01-30 22:52:07 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:49645: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
description:
2025-01-30 22:52:19 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:52608: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.118.123
description:
Jan 30 22:52:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.118.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Jan 30 22:52:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-01-30 22:52:35 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:53112: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.101.204.242
description:
2025-01-30 22:52:40 dovecot_plain authenticator failed for ([112.101.204.242]) [112.101.204.242]:33718: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-01-30 22:52:53 dovecot_login authenticator failed for syn-098-010-121-246.res.spectrum.com [98.10.121.246]:48358: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.118.123
description:
2025-01-30 22:52:34 dovecot_plain authenticator failed for ([60.174.118.123]) [60.174.118.123]:47462: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Jan 30 22:52:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
description:
2025-01-30 22:52:59 dovecot_login authenticator failed for ([222.174.142.78]) [222.174.142.78]:55783: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Jan 30 22:53:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
description:
2025-01-30 22:53:19 dovecot_login authenticator failed for ([122.228.225.21]) [122.228.225.21]:53475: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
description:
2025-01-30 22:53:31 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:6821: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
description:
Jan 30 22:53:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 30 22:52:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-30 22:53:01 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:58715: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Jan 30 22:53:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-01-30 22:53:20 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:39565: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.101.204.242
description:
Jan 30 22:52:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.101.204.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.174.142.78
description:
Jan 30 22:52:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.174.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
description:
Jan 30 22:53:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-01-30 22:53:17 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:39986: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
description:
Jan 30 22:53:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Jan 30 22:53:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Jan 30 22:53:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 30 22:53:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-01-30 22:53:48 dovecot_login authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:45601: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-30 22:53:46 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:44560: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Jan 30 22:53:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
description:
Jan 30 22:54:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.53.152.38
description:
Jan 30 22:54:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.53.152.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-01-30 22:53:33 dovecot_login authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:51390: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.168.78.213
description:
[2025-01-30 22:53:41 +0100] info [webmaild] 105.168.78.213 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Jan 30 22:53:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.86.114.43
description:
Jan 30 22:53:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.86.114.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-01-30 22:53:56 dovecot_login authenticator failed for ([180.71.9.57]) [180.71.9.57]:53206: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 30 22:53:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-54.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.53.152.38
description:
2025-01-30 22:54:31 dovecot_login authenticator failed for ([71.53.152.38]) [71.53.152.38]:44709: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-30 22:53:34 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:38975: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
description:
2025-01-30 22:53:43 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:50125: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
description:
2025-01-30 22:53:43 dovecot_plain authenticator failed for ([178.76.69.221]) [178.76.69.221]:48156: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.86.114.43
description:
2025-01-30 22:53:56 dovecot_login authenticator failed for (colegioarnaldo241.static.host.gvt.net.br) [201.86.114.43]:36073: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 30 22:53:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
description:
Jan 30 22:53:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
description:
2025-01-30 22:54:16 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:35101: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.104.115.57
description:
[2025-01-30 22:54:31 +0100] info [webmaild] 191.104.115.57 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
description:
2025-01-30 22:53:32 dovecot_plain authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:37404: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-30 22:54:01 dovecot_login authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:37101: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
description:
2025-01-30 22:55:11 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:51327: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 30 22:55:22 ait sshd[1203036]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 22:55:25 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:35736: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 30 22:54:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-30 22:54:47 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:42918: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
description:
2025-01-30 22:55:14 dovecot_login authenticator failed for 1-34-162-249.hinet-ip.hinet.net ([127.0.0.1]) [1.34.162.249]:35356: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-01-30 22:54:38 dovecot_login authenticator failed for ([218.55.177.39]) [218.55.177.39]:58624: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.161.96
description:
2025-01-30 22:54:43 dovecot_login authenticator failed for dynamic-acs-24-112-161-96.zoominternet.net [24.112.161.96]:60470: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.254.93.70
description:
2025-01-30 22:54:50 dovecot_login authenticator failed for ([61.254.93.70]) [61.254.93.70]:40044: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.21.254.67
description:
Jan 30 22:55:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.21.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 30 22:55:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-30 22:55:28 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:33980: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Jan 30 22:55:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 22:54:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Jan 30 22:54:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-01-30 22:54:49 dovecot_login authenticator failed for ([175.117.144.158]) [175.117.144.158]:34024: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.21.254.67
description:
2025-01-30 22:55:08 dovecot_login authenticator failed for ([127.0.0.1]) [37.21.254.67]:59378: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
description:
2025-01-30 22:54:36 dovecot_login authenticator failed for ([195.158.19.6]) [195.158.19.6]:44936: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.112.161.96
description:
Jan 30 22:54:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.112.161.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Jan 30 22:54:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
description:
Jan 30 22:55:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Jan 30 22:54:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.254.93.70
description:
Jan 30 22:54:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.254.93.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
description:
Jan 30 22:54:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 30 22:55:22 ait sshd[1203036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.4.235
description:
[2025-01-30 22:55:27 +0100] info [webmaild] 177.87.4.235 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.230.227.161
description:
[2025-01-30 22:54:35 +0100] info [webmaild] 88.230.227.161 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 22:55:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-01-30 22:55:00 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:38337: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.144.125
description:
2025-01-30 22:55:02 dovecot_login authenticator failed for ([127.0.0.1]) [219.157.144.125]:38386: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.95.162.177
description:
Jan 30 22:56:00 ait sshd[1203413]: pam_imunify(sshd:auth): [IM360_RBL] The IP 141.95.162.177 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 111.118.178.159
domain: test.aitstaff.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-56.111.118.178.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Jan 30 22:55:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 141.95.162.177
description:
Jan 30 22:56:00 ait sshd[1203413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.162.177


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 198.177.125.115
domain: test.aitstaff.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-56.198.177.125.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
description:
Jan 30 22:55:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
description:
2025-01-30 22:55:44 dovecot_login authenticator failed for ([127.0.0.1]) [122.187.227.190]:59459: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.121.193.191
description:
2025-01-30 22:55:52 dovecot_login authenticator failed for syn-070-121-193-191.res.spectrum.com ([127.0.0.1]) [70.121.193.191]:44487: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-01-30 22:55:33 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:46040: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-01-30 22:55:41 dovecot_plain authenticator failed for ([125.142.39.13]) [125.142.39.13]:37756: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-01-30 22:57:27 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:41001: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:57:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 30 22:57:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
description:
Jan 30 22:57:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
description:
2025-01-30 22:57:16 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:43579: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-30 22:57:26 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:34850: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.221.222.126
domain: test.aitstaff.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-56.103.221.222.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
description:
Jan 30 22:57:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
description:
2025-01-30 22:57:21 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:51374: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.244.166.160
description:
Jan 30 22:57:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.244.166.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 22:56:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.4.153.7
description:
Jan 30 22:57:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.4.153.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
description:
Jan 30 22:57:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
description:
2025-01-30 22:57:13 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:54877: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Jan 30 22:57:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 30 22:57:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-30 22:57:29 dovecot_plain authenticator failed for ([60.223.252.57]) [60.223.252.57]:57950: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
description:
2025-01-30 22:57:11 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:37876: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Jan 30 22:57:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.115.181
description:
2025-01-30 22:57:44 dovecot_plain authenticator failed for p68182-obmd01.osaka.ocn.ne.jp [180.7.115.181]:41761: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 22:57:49 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:47707: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.20.28.140
description:
[2025-01-30 22:58:28 +0100] info [webmaild] 187.20.28.140 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
description:
Jan 30 22:58:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
description:
2025-01-30 22:58:13 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:59506: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.173.89
description:
[2025-01-30 22:58:24 +0100] info [webmaild] 191.243.173.89 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-01-30 22:57:37 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:59256: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-30 22:57:41 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:38401: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.95.162.177
description:
Jan 30 22:57:50 ait sshd[1204057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 141.95.162.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-30 22:57:56 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:52486: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.219.11.183
description:
[2025-01-30 22:57:38 +0100] info [webmaild] 45.219.11.183 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 30 22:57:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.115.181
description:
Jan 30 22:57:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.115.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:57:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 30 22:58:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.244.166.160
description:
2025-01-30 22:57:33 dovecot_login authenticator failed for ([127.0.0.1]) [14.244.166.160]:59816: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.233.108
description:
2025-01-30 22:58:20 dovecot_login authenticator failed for bb116-14-233-108.singnet.com.sg ([127.0.0.1]) [116.14.233.108]:56540: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-30 22:58:27 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:48076: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 141.95.162.177
description:
Jan 30 22:57:50 ait sshd[1204057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.162.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-30 22:58:08 dovecot_plain authenticator failed for ([80.241.253.238]) [2.57.219.2]:56964: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 30 22:58:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.233.108
description:
Jan 30 22:58:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.233.108 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.177
description:
Jan 30 22:59:06 ait sshd[1204660]: Failed password for invalid user xj from 141.95.162.177 port 39664 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.117.118
description:
2025-01-30 22:59:11 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:23395: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-30 22:58:35 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:33226: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
description:
Jan 30 22:58:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
description:
2025-01-30 22:58:53 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:43454: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.238.103
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:22-59.157.245.238.103


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 141.95.162.177
description:
Jan 30 22:59:04 ait sshd[1204660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.162.177


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.117.118
description:
Jan 30 22:59:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.164.176.146
description:
Jan 30 22:59:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.164.176.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.164.176.146
description:
2025-01-30 22:59:28 dovecot_plain authenticator failed for ([123.164.176.146]) [123.164.176.146]:51895: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.95.162.177
description:
Jan 30 22:59:04 ait sshd[1204660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 141.95.162.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-30 22:59:12 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:28782: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 30 22:58:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 30 22:59:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.72.68
description:
[2025-01-30 22:59:18 +0100] info [webmaild] 190.89.72.68 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.116.22
description:
Jan 30 22:59:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.116.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Jan 30 23:00:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-01-30 23:00:06 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (arion) [80.15.78.70]:33564: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-30 23:00:21 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:40446: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 100.37.1.10
description:
Jan 30 22:59:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 100.37.1.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 22:59:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Jan 30 23:00:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 30 23:00:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.1.10
description:
2025-01-30 22:59:35 dovecot_plain authenticator failed for pool-100-37-1-10.nycmny.fios.verizon.net [100.37.1.10]:51726: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.116.22
description:
2025-01-30 22:59:52 dovecot_plain authenticator failed for bb116-14-116-22.singnet.com.sg [116.14.116.22]:38907: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-01-30 23:00:11 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:60478: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.143
description:
Jan 30 23:00:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 23:00:58 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:64723: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-01-30 23:01:12 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:50955: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 23:00:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.70.29.195
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:23-01.146.70.29.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
description:
2025-01-30 23:01:29 dovecot_plain authenticator failed for ([5.130.173.74]) [5.130.173.74]:36920: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
description:
Jan 30 23:01:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.249.164
description:
Jan 30 23:01:05 ait sshd[1205466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 112.132.249.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.132.249.164
description:
Jan 30 23:01:05 ait sshd[1205466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.132.249.164  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Jan 30 23:01:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
description:
Jan 30 23:01:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.143
description:
2025-01-30 23:00:51 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.143]:9077: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
description:
2025-01-30 23:01:04 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:56308: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.154.245.150
description:
[2025-01-30 23:01:50 +0100] info [webmaild] 105.154.245.150 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.206.7
description:
[2025-01-30 23:02:20 +0100] info [webmaild] 128.201.206.7 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
description:
Jan 30 23:01:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
description:
2025-01-30 23:01:49 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:48082: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.15.60.138
description:
Jan 30 23:02:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.15.60.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.15.60.138
description:
2025-01-30 23:02:16 dovecot_plain authenticator failed for ([103.15.60.138]) [103.15.60.138]:60018: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-01-30 23:02:56 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:57850: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.65.20
description:
Jan 30 23:02:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.65.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.65.20
description:
2025-01-30 23:02:40 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.65.20]:39048: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Jan 30 23:02:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
description:
2025-01-30 23:02:53 dovecot_plain authenticator failed for (23-94-85-164-host.colocrossing.com) [23.94.85.164]:60594: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.95.18
description:
Jan 30 23:03:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.95.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.218.189.178
description:
[2025-01-30 23:03:15 +0100] info [webmaild] 201.218.189.178 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.88.11
description:
2025-01-30 23:02:40 dovecot_plain authenticator failed for ([46.210.88.11]) [46.210.88.11]:39468: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 30 23:03:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 23:02:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.34.147
description:
Jan 30 23:02:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.34.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.117.84
description:
Jan 30 23:03:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.117.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.117.84
description:
2025-01-30 23:03:17 dovecot_plain authenticator failed for ([165.90.117.84]) [165.90.117.84]:41012: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.235.216.228
description:
[2025-01-30 23:02:42 +0100] info [webmaild] 45.235.216.228 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
description:
Jan 30 23:02:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 30 23:03:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
description:
2025-01-30 23:03:17 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:56170: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-30 23:02:46 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:35523: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
description:
Jan 30 23:02:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
description:
2025-01-30 23:02:50 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:42924: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-30 23:03:04 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:5157: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-30 23:03:10 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:49458: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.210.88.11
description:
Jan 30 23:02:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.210.88.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.82
description:
Jan 30 23:03:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.82
description:
2025-01-30 23:03:35 dovecot_plain authenticator failed for (nsg-corporate-82.227.187.122.airtel.in) [122.187.227.82]:50470: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.33
description:
2025-01-30 23:05:25 dovecot_login authenticator failed for (ADMIN) [154.47.30.33]:43648: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.204.154.156
description:
[2025-01-30 23:06:05 +0100] info [webmaild] 37.204.154.156 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 30 23:06:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-30 23:06:18 dovecot_login authenticator failed for ([78.142.41.167]) [78.142.41.167]:59874: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 30 23:06:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-30 23:06:28 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:19835: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
description:
2025-01-30 23:05:37 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:33072: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
description:
Jan 30 23:06:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
description:
2025-01-30 23:06:03 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:48039: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
description:
Jan 30 23:05:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.132.249.164
description:
Jan 30 23:07:03 ait sshd[1207702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.132.249.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.37.174.4
description:
[2025-01-30 23:07:29 +0100] info [webmaild] 201.37.174.4 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.26.177.53
description:
[2025-01-30 23:06:34 +0100] info [webmaild] 200.26.177.53 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-06.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.105.161
description:
[2025-01-30 23:06:55 +0100] info [webmaild] 45.233.105.161 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.249.164
description:
Jan 30 23:07:03 ait sshd[1207702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 112.132.249.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 30 23:08:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 30 23:09:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-30 23:09:18 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:55804: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
description:
2025-01-30 23:09:29 dovecot_plain authenticator failed for ([37.204.100.181]) [37.204.100.181]:57296: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
description:
Jan 30 23:09:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-30 23:08:56 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:53759: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 30 23:09:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 23:09:06 dovecot_plain authenticator failed for ([216.194.174.74]) [216.194.174.27]:49173: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.242.131.209
description:
2025-01-30 23:09:14 dovecot_login authenticator failed for (ait.edu.gh) [180.242.131.209]:15026: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.83.93
description:
2025-01-30 23:09:17 dovecot_login authenticator failed for (31094-49731.bacloud.info.) [196.170.83.93]:50779: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.100.208.56
description:
2025-01-30 23:09:54 dovecot_login authenticator failed for 79-100-208-56.ip.btc-net.bg (ait.edu.gh) [79.100.208.56]:3954: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 23:10:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 23:10:09 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (nontromble) [51.255.84.180]:49112: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.159.97
description:
[2025-01-30 23:10:11 +0100] info [webmaild] 176.29.159.97 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.208.56
description:
Jan 30 23:09:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.208.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.177.172.156
description:
[2025-01-30 23:10:58 +0100] info [webmaild] 102.177.172.156 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.140.250.74
description:
[2025-01-30 23:11:02 +0100] info [webmaild] 200.140.250.74 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 23:11:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
description:
2025-01-30 23:12:16 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:57543: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
description:
2025-01-30 23:12:28 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:49618: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-30 23:12:29 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:46726: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.213.176.177
description:
[2025-01-30 23:11:53 +0100] info [webmaild] 186.213.176.177 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
description:
Jan 30 23:12:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
description:
Jan 30 23:12:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 30 23:12:27 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
description:
Jan 30 23:12:53 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
description:
2025-01-30 23:12:57 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:51689: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 23:13:13 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.116.226
description:
2025-01-30 23:13:13 dovecot_plain authenticator failed for ([117.176.116.226]) [117.176.116.226]:57930: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
description:
Jan 30 23:12:39 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-01-30 23:12:41 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:57372: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-01-30 23:12:45 dovecot_login authenticator failed for ([5.31.13.120]) [5.31.13.120]:40052: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
description:
Jan 30 23:12:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
description:
Jan 30 23:13:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 23:13:15 ait sshd[1210311]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 23:13:15 ait sshd[1210311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Jan 30 23:12:43 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
description:
2025-01-30 23:12:55 dovecot_login authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:60725: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 30 23:13:47 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.0
description:
47.128.120.0 - - [30/Jan/2025:23:13:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8990630 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/50032b?panel=swiftmailer" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 30 23:14:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.202.224
description:
Jan 30 23:14:16 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.202.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-01-30 23:14:09 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:55960: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-30 23:14:20 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:59138: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-30 23:13:49 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:14726: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.160.246
description:
[2025-01-30 23:14:14 +0100] info [webmaild] 41.56.160.246 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
description:
Jan 30 23:13:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
description:
2025-01-30 23:13:57 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:36088: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-30 23:14:07 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (crables) [94.45.76.149]:37841: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.224
description:
2025-01-30 23:14:18 dovecot_plain authenticator failed for ([196.46.202.224]) [196.46.202.224]:44469: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
description:
Jan 30 23:13:58 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Jan 30 23:14:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-30 23:14:13 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:58488: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 30 23:14:05 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 30 23:14:18 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
description:
2025-01-30 23:14:00 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:50190: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.20.15.167
description:
Jan 30 23:15:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.20.15.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Jan 30 23:15:15 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-01-30 23:15:17 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:41300: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 100.37.1.10
description:
Jan 30 23:14:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 100.37.1.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-30 23:15:08 dovecot_plain authenticator failed for ([201.91.196.177]) [186.238.43.146]:33122: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.124.19.203
description:
[2025-01-30 23:15:03 +0100] info [webmaild] 189.124.19.203 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.113.91.98
description:
2025-01-30 23:15:17 dovecot_plain authenticator failed for ([223.113.91.98]) [223.113.91.98]:57429: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 30 23:14:36 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-30 23:14:38 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:27683: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
description:
2025-01-30 23:15:01 dovecot_plain authenticator failed for ([222.67.186.253]) [222.67.186.253]:45082: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-01-30 23:14:48 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:46001: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
description:
Jan 30 23:14:54 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Jan 30 23:15:23 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
description:
2025-01-30 23:14:56 dovecot_plain authenticator failed for ([219.144.16.16]) [219.144.16.16]:33699: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 30 23:15:00 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-30 23:15:02 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:54961: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-30 23:15:25 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:40758: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.113.91.98
description:
Jan 30 23:15:15 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.113.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
description:
2025-01-30 23:14:37 dovecot_plain authenticator failed for ([113.59.34.8]) [113.59.34.5]:45036: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 30 23:15:06 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.20.15.167
description:
2025-01-30 23:15:16 dovecot_plain authenticator failed for ([60.20.15.167]) [60.20.15.167]:53710: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.1.10
description:
2025-01-30 23:14:40 dovecot_plain authenticator failed for pool-100-37-1-10.nycmny.fios.verizon.net [100.37.1.10]:49374: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Jan 30 23:14:46 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.186.253
description:
Jan 30 23:14:59 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.186.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.59.34.5
description:
Jan 30 23:14:35 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.59.34.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.72.218.180
description:
[2025-01-30 23:14:59 +0100] info [webmaild] 185.72.218.180 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Jan 30 23:15:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
description:
2025-01-30 23:16:18 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:59486: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.107.193
description:
Jan 30 23:16:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.107.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-30 23:16:10 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (unfunes) [62.63.230.241]:44494: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 30 23:16:08 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
description:
2025-01-30 23:16:28 dovecot_plain authenticator failed for ([220.180.107.193]) [220.180.107.193]:38495: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 23:15:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
description:
Jan 30 23:16:16 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 30 23:16:28 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-30 23:16:30 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:57838: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 14.139.183.115
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:23-15.14.139.183.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 30 23:15:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.181.29.231
description:
[2025-01-30 23:15:54 +0100] info [webmaild] 168.181.29.231 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.220.161
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:23-16.157.245.220.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-01-30 23:15:47 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:56946: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-30 23:15:57 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:2254: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
description:
Jan 30 23:16:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Jan 30 23:17:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-01-30 23:17:09 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:65184: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-01-30 23:16:40 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:34480: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
description:
2025-01-30 23:17:06 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [101.100.184.80]:51706: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.175
description:
47.128.99.175 - - [30/Jan/2025:23:17:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19137088 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?duration=short%2Cmedium&filter_course-language=121&filtering=1&instructor=2&level=intermediate%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
description:
2025-01-30 23:17:28 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:52719: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-30 23:17:28 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:32652: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Jan 30 23:16:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
description:
Jan 30 23:17:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


