# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.25.167.177
description:
2025-01-26 00:06:09 dovecot_plain authenticator failed for c-76-25-167-177.hsd1.co.comcast.net [76.25.167.177]:50389: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.idea/misc.xml||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-01-26 00:06:29 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:60604: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.154
description:
Jan 26 00:07:14 ait sshd[1871500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.154  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
description:
2025-01-26 00:06:33 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:56076: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-01-26 00:06:40 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:35842: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 26 00:07:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
description:
Jan 26 00:06:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/log/development.log||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Jan 26 00:06:29 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
description:
Jan 26 00:06:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Jan 26 00:06:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.75.171.174
description:
Jan 26 00:06:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.75.171.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.75.171.174
description:
2025-01-26 00:06:20 dovecot_plain authenticator failed for 174.subnet-24-75-171.ellijay.com [24.75.171.174]:57921: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Jan 26 00:07:14 ait sshd[1871500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Jan 26 00:06:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-26 00:07:16 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:41064: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-01-26 00:06:31 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:44202: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.155.248.196
description:
Jan 26 00:06:35 ait sshd[1870850]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.155.248.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
description:
2025-01-26 00:06:51 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:49611: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
description:
Jan 26 00:06:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
description:
2025-01-26 00:06:24 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:37410: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.155.248.196
description:
Jan 26 00:06:35 ait sshd[1870850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.155.248.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
description:
2025-01-26 00:07:35 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:33114: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-01-26 00:07:39 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:47053: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.83.38.15
description:
2025-01-26 00:07:43 dovecot_plain authenticator failed for (50-83-38-15.client.mchsi.com) [50.83.38.15]:53602: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-01-26 00:08:13 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:36138: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-26 00:08:04 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:52445: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Jan 26 00:07:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-01-26 00:07:28 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:56310: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-26 00:07:28 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:52190: 535 Incorrect authentication data (set_id=abs3)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/anchor/errors.log||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.83.38.15
description:
Jan 26 00:07:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.83.38.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.218
description:
2025-01-26 00:07:24 dovecot_login authenticator failed for ([195.178.110.218]) [195.178.110.218]:63258: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 00:07:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 00:08:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Jan 26 00:07:18 ait sshd[1871500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 26 00:08:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.218
description:
Jan 26 00:07:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 26 00:07:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Jan 26 00:07:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-26 00:08:33 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:52968: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-01-26 00:08:46 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:55168: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.ssh/config||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.79.83.28
description:
2025-01-26 00:09:10 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:53286: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/css/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Jan 26 00:08:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-01-26 00:08:30 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:36634: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Jan 26 00:08:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-01-26 00:08:43 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:57264: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
description:
2025-01-26 00:08:55 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:48605: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 26 00:08:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.79.83.28
description:
Jan 26 00:09:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.79.83.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-26 00:09:13 dovecot_plain authenticator failed for ([218.28.77.206]) [218.28.77.206]:60557: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-26 00:08:22 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:56436: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/sql/dump.sql||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 00:08:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
description:
2025-01-26 00:09:35 dovecot_plain authenticator failed for ([118.91.176.244]) [118.91.176.244]:54133: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Jan 26 00:09:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-01-26 00:09:39 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:54563: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-26 00:10:06 dovecot_plain authenticator failed for ([218.1.239.146]) [116.231.84.13]:49140: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/log/vpn.log||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Jan 26 00:09:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-01-26 00:09:54 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:59682: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-01-26 00:09:55 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:52152: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 00:09:55 ait sshd[1874137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 26 00:09:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.185.163
description:
2025-01-26 00:10:07 dovecot_plain authenticator failed for ([111.53.185.163]) [111.53.185.163]:53232: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 00:10:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Jan 26 00:10:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Jan 26 00:09:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.225.68.108
description:
Jan 26 00:09:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.225.68.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-01-26 00:09:26 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:51184: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-26 00:09:48 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:34495: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Jan 26 00:09:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 26 00:10:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.225.68.108
description:
2025-01-26 00:09:23 dovecot_plain authenticator failed for 90-225-68-108-no2666.tbcn.telia.com [90.225.68.108]:49454: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-01-26 00:09:25 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:52378: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.64.20
description:
Jan 26 00:09:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.64.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 26 00:09:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Jan 26 00:09:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-26 00:09:52 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:58873: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-26 00:10:07 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:11084: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.114.231
description:
2025-01-26 00:10:16 dovecot_plain authenticator failed for ([90.188.114.231]) [90.188.114.231]:35590: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 26 00:10:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:00-09.65.0.27.59||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-01-26 00:09:54 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:3298: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 00:09:55 ait sshd[1874137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.idea/vcs.xml||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.64.20
description:
2025-01-26 00:09:34 dovecot_plain authenticator failed for ([94.207.64.20]) [94.207.64.20]:51736: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.114.231
description:
Jan 26 00:10:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.114.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
description:
2025-01-26 00:10:25 dovecot_plain authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:59011: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.8.143
description:
Jan 26 00:10:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.8.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/localhost.key||User:lemsas||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.50.125
description:
Jan 26 00:10:59 ait sshd[1875304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.50.125 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 94.228.162.228
domain: elibrary-edu.net
description:
IM360 WAF: Track file upload for Infectors||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/elibrary-edu.net/modules/mod_ariimageslidersa||User:titlemas||WPU:||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL block known shells
abuser: 94.228.162.228
domain: elibrary-edu.net
description:
IM360 WAF: RBL block known shells||MVN:ARGS:p1||WPU:||RSV:6.65||T:APACHE||MV:uploadFile||SC:/home/titlemas/public_html/elibrary-edu.net/modules/mod_ariimageslidersa


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-01-26 00:10:19 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:59941: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:6.65||T:APACHE||MV:settings.php.swp||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.50.125
description:
Jan 26 00:10:59 ait sshd[1875304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.50.125


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.6.119
description:
Jan 26 00:11:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.6.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-01-26 00:12:08 dovecot_plain authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:56357: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/js/engine1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
description:
2025-01-26 00:11:59 dovecot_plain authenticator failed for ([58.17.6.119]) [58.17.6.119]:35397: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
description:
Jan 26 00:12:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/conn.php.bak||User:lemsas||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.63.75
description:
Jan 26 00:12:30 ait sshd[1876525]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.248.63.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/data1/images/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/data1


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/app/config/parameters.yml.dist||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.248.63.75
description:
Jan 26 00:12:30 ait sshd[1876525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.248.63.75  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 00:12:45 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Jan 26 00:13:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-01-26 00:13:06 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:46152: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.149.53
description:
Jan 26 00:12:19 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.149.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/application/logs/default.log||User:lemsas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.197.137.162
description:
2025-01-26 00:12:41 dovecot_plain authenticator failed for static-dsl-162.87-197-137.telecom.sk [87.197.137.162]:34289: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.149.53
description:
2025-01-26 00:12:21 dovecot_plain authenticator failed for ([182.176.149.53]) [182.176.149.53]:50562: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.197.137.162
description:
Jan 26 00:12:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.197.137.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 00:12:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Jan 26 00:13:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-01-26 00:13:15 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:40768: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.72.158
description:
2025-01-26 00:14:10 dovecot_plain authenticator failed for ([113.200.72.158]) [113.200.72.158]:58086: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-01-26 00:14:11 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:57158: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-26 00:14:17 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:40586: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 00:13:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.32.104
description:
Jan 26 00:13:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.32.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 26 00:14:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
description:
2025-01-26 00:13:47 dovecot_plain authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:41724: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.72.158
description:
Jan 26 00:14:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.72.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
description:
2025-01-26 00:13:57 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:39184: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Jan 26 00:14:11 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Jan 26 00:13:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
description:
2025-01-26 00:13:56 dovecot_plain authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:50188: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-01-26 00:13:45 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:55720: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
description:
Jan 26 00:13:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
description:
2025-01-26 00:13:49 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:53886: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.6.251.202
description:
2025-01-26 00:14:05 dovecot_plain authenticator failed for ([117.6.251.202]) [117.6.251.202]:49960: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/js/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.162
description:
Jan 26 00:13:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.138.162
description:
2025-01-26 00:13:33 dovecot_plain authenticator failed for (201-63-138-162.customer.tdatabrasil.net.br) [201.63.138.162]:49302: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.20.8.25
description:
2025-01-26 00:13:41 dovecot_plain authenticator failed for ([5.20.8.25]) [5.20.8.25]:43724: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
description:
Jan 26 00:13:45 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-01-26 00:13:53 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:54532: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/host.key||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.11
description:
Jan 26 00:13:55 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.6.251.202
description:
Jan 26 00:14:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.6.251.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 26 00:14:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Jan 26 00:14:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-01-26 00:14:13 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:40003: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.20.8.25
description:
Jan 26 00:13:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.20.8.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-26 00:14:06 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:42170: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 26 00:13:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-26 00:13:40 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:47704: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Jan 26 00:13:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
description:
Jan 26 00:13:55 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.11
description:
2025-01-26 00:13:57 dovecot_plain authenticator failed for ([188.59.178.11]) [188.59.178.11]:59009: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.htpasswd.bkp||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/site_cg/application/configs/application.ini||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Jan 26 00:14:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.63.75
description:
Jan 26 00:14:54 ait sshd[1878821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.248.63.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.251.23.95
description:
2025-01-26 00:14:25 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [171.251.23.95]:42074: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-01-26 00:14:53 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:57501: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.180.88.72
description:
2025-01-26 00:14:22 dovecot_plain authenticator failed for static-47-180-88-72.lsan.ca.frontiernet.net ([65.255.196.42]) [47.180.88.72]:36356: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 26 00:14:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-01-26 00:14:40 dovecot_plain authenticator failed for ([50.223.176.171]) [50.223.176.171]:54866: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.177.204.122
description:
Jan 26 00:15:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.177.204.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.204.122
description:
2025-01-26 00:15:08 dovecot_plain authenticator failed for (boteums) [154.177.204.122]:46514: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.88.72
description:
Jan 26 00:14:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.180.88.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Jan 26 00:14:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-01-26 00:14:56 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:46880: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.250.121
description:
2025-01-26 00:14:45 dovecot_plain authenticator failed for p94121-obmd01.tokyo.ocn.ne.jp [124.101.250.121]:53432: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.248.232.70
description:
Jan 26 00:15:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.248.232.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.248.232.70
description:
2025-01-26 00:15:03 dovecot_plain authenticator failed for ([89.248.232.70]) [89.248.232.70]:41780: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Jan 26 00:14:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.23.95
description:
Jan 26 00:14:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.251.23.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-01-26 00:14:25 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:50788: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.248.63.75
description:
Jan 26 00:14:54 ait sshd[1878821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.248.63.75  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-26 00:14:42 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:12974: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Jan 26 00:14:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.213.187.41
description:
Jan 26 00:15:40 ait sshd[1879737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.213.187.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
description:
2025-01-26 00:15:58 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:46587: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-01-26 00:15:31 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:34356: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
description:
Jan 26 00:15:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
description:
Jan 26 00:16:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77318034
name: IM360 WAF: Blocked access to git folder
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Blocked access to git folder||RSV:6.65||T:APACHE||MV:/.git/refs/awbegvag.php?id=javascript:alert(1)||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/js/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.213.187.41
description:
Jan 26 00:15:40 ait sshd[1879737]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.213.187.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
description:
Jan 26 00:16:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-26 00:15:23 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:53490: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 26 00:15:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
description:
2025-01-26 00:16:10 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:33336: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-26 00:15:40 dovecot_plain authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:51271: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 26 00:15:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/tiaqrcil.bak||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Jan 26 00:15:29 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 26 00:15:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-01-26 00:15:51 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:46119: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
description:
2025-01-26 00:16:09 dovecot_plain authenticator failed for ([58.18.88.146]) [58.18.88.146]:44192: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Jan 26 00:15:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-26 00:15:53 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:34990: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
description:
Jan 26 00:16:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-01-26 00:16:04 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:64578: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.htaccess.bak||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.196
description:
2025-01-26 00:17:18 dovecot_plain authenticator failed for ([76.77.25.196]) [76.77.25.196]:42514: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 26 00:17:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.37.90
description:
Jan 26 00:16:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.37.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 26 00:16:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-26 00:16:37 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:38834: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.196
description:
Jan 26 00:17:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-26 00:17:11 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:46930: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/images/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.9.7.174
description:
Jan 26 00:16:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.9.7.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
description:
2025-01-26 00:16:35 dovecot_plain authenticator failed for ([185.232.37.90]) [185.232.37.90]:45982: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 26 00:16:38 ait sshd[1880680]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 26 00:16:38 ait sshd[1880680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 26 00:16:42 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-26 00:16:44 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:56506: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.9.7.174
description:
2025-01-26 00:16:28 dovecot_plain authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:58946: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.240.110
description:
Jan 26 00:16:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.240.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
description:
2025-01-26 00:16:38 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:34314: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 26 00:16:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-26 00:16:58 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:48457: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 00:17:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/.htaccess.bak||User:lemsas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.240.110
description:
2025-01-26 00:16:32 dovecot_plain authenticator failed for (187-51-240-110.customer.tdatabrasil.net.br) [187.51.240.110]:44610: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
description:
Jan 26 00:16:36 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
description:
2025-01-26 00:17:32 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:16454: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.209.199
description:
2025-01-26 00:17:32 dovecot_plain authenticator failed for ([177.44.209.199]) [177.44.209.199]:47220: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 26 00:17:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.248.209
description:
Jan 26 00:17:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.248.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.42.105
description:
2025-01-26 00:17:55 dovecot_plain authenticator failed for ([112.184.42.105]) [112.184.42.105]:49509: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
description:
Jan 26 00:18:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.idea/dataSources.xml||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-26 00:17:20 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:14746: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/js/js/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Jan 26 00:17:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.248.209
description:
2025-01-26 00:17:56 dovecot_plain authenticator failed for ([223.84.248.209]) [223.84.248.209]:1061: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-01-26 00:18:14 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:35707: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-01-26 00:18:17 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:56096: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.209.199
description:
Jan 26 00:17:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.209.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 26 00:18:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 26 00:17:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.175.48.5
description:
Jan 26 00:18:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.175.48.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 26 00:18:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
description:
Jan 26 00:17:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-26 00:17:42 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:48592: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/log/system.log||User:lemsas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-26 00:17:44 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:60766: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.42.105
description:
Jan 26 00:17:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.42.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Jan 26 00:18:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-01-26 00:18:03 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:55244: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Jan 26 00:18:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 26 00:17:42 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.175.48.5
description:
2025-01-26 00:18:05 dovecot_plain authenticator failed for ([39.175.48.5]) [39.175.48.5]:11745: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
description:
2025-01-26 00:18:08 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:46734: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 26 00:19:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
description:
2025-01-26 00:18:23 dovecot_plain authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:55614: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 00:18:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.111
description:
Jan 26 00:19:02 ait sshd[1882896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.111  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.111
description:
Jan 26 00:19:02 ait sshd[1882896]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 26 00:19:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-26 00:18:18 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:46317: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 26 00:18:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.106
description:
2025-01-26 00:18:51 dovecot_plain authenticator failed for ([125.23.204.106]) [125.23.204.106]:46676: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-26 00:19:14 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:50340: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-26 00:18:30 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:37707: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wordpress/wp-content/debug.log||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.204.106
description:
Jan 26 00:18:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.204.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-26 00:19:12 dovecot_plain authenticator failed for ([203.252.10.3]) [203.252.10.3]:55168: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/jvu7al96.cvsignore||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.249
description:
Jan 26 00:18:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config/properties.ini||User:lemsas||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/temp.sql||User:lemsas||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.233
description:
Jan 26 00:19:51 ait sshd[1883523]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.233
description:
Jan 26 00:19:51 ait sshd[1883523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.233  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Jan 26 00:19:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 00:19:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 26 00:20:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-26 00:20:02 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:33944: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: modsec
rule: 77318034
name: IM360 WAF: Blocked access to git folder
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Blocked access to git folder||RSV:6.65||T:APACHE||MV:/.git/09881435.php?id=javascript:alert(1)||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.111
description:
Jan 26 00:19:18 ait sshd[1883044]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-01-26 00:19:25 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:1602: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Jan 26 00:20:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Jan 26 00:21:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/users.sql||User:lemsas||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
description:
Jan 26 00:20:22 ait sshd[1884456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
description:
Jan 26 00:20:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-01-26 00:21:01 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:33152: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.175.48.5
description:
Jan 26 00:21:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.175.48.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.175.48.5
description:
2025-01-26 00:21:12 dovecot_plain authenticator failed for ([39.175.48.5]) [39.175.48.5]:22144: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
description:
Jan 26 00:20:22 ait sshd[1884456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
description:
2025-01-26 00:20:58 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:48240: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 26 00:21:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-01-26 00:21:11 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:40492: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 26 00:20:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-26 00:20:24 dovecot_plain authenticator failed for (bakeriess) [213.57.214.111]:47457: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.htaccess.bkp||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-01-26 00:21:10 dovecot_plain authenticator failed for ([220.95.14.102]) [220.95.14.102]:39192: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Jan 26 00:21:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
description:
2025-01-26 00:21:57 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:43352: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Jan 26 00:21:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-01-26 00:22:04 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:37984: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 26 00:21:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
description:
Jan 26 00:21:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 26 00:21:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
description:
2025-01-26 00:21:44 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:44360: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Jan 26 00:22:11 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Jan 26 00:21:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Jan 26 00:22:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 26 00:22:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-26 00:21:19 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:2332: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-01-26 00:21:21 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:33136: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-01-26 00:22:04 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:46170: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-26 00:22:11 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:39480: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.19
description:
2025-01-26 00:21:41 dovecot_plain authenticator failed for ([121.202.153.19]) [121.202.153.19]:7415: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 26 00:21:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-01-26 00:21:55 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:54072: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-01-26 00:22:01 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:50772: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Jan 26 00:22:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-01-26 00:22:11 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:45282: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-01-26 00:21:26 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:44041: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/adminer/index.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
description:
Jan 26 00:21:55 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-01-26 00:21:50 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:51434: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-26 00:21:54 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:39844: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 26 00:22:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.18.139.82
description:
Jan 26 00:21:19 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.18.139.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 00:21:33 ait sshd[1885680]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.19
description:
Jan 26 00:21:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-01-26 00:21:35 dovecot_plain authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:46838: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-01-26 00:21:39 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:59992: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-26 00:22:09 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:32963: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 00:21:33 ait sshd[1885680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-01-26 00:22:00 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:36129: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Jan 26 00:22:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Jan 26 00:21:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 26 00:22:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-26 00:22:07 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:24645: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-01-26 00:22:13 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:35202: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
description:
Jan 26 00:21:42 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Jan 26 00:21:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/default.php.bak||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.34.229
description:
Jan 26 00:22:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.34.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.34.229
description:
2025-01-26 00:23:01 dovecot_plain authenticator failed for ([124.152.34.229]) [124.152.34.229]:44680: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/images/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-26 00:22:31 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:46911: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.102
description:
2025-01-26 00:22:30 dovecot_plain authenticator failed for ([102.69.163.102]) [102.69.163.102]:58544: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.26.106
description:
Jan 26 00:23:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.26.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.102
description:
Jan 26 00:22:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 26 00:22:29 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.9.7.174
description:
Jan 26 00:22:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.9.7.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.9.7.174
description:
2025-01-26 00:22:42 dovecot_plain authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:34586: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.26.106
description:
2025-01-26 00:23:12 dovecot_plain authenticator failed for ([58.240.26.106]) [58.240.26.106]:7489: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 26 00:23:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-01-26 00:23:47 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:56430: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-01-26 00:23:58 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:34902: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
description:
2025-01-26 00:23:30 dovecot_plain authenticator failed for ([58.16.8.106]) [58.16.8.106]:53945: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 26 00:23:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Jan 26 00:23:45 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-26 00:23:45 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:55864: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
description:
Jan 26 00:23:55 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Jan 26 00:23:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
description:
2025-01-26 00:23:57 dovecot_plain authenticator failed for ([210.84.5.183]) [210.84.5.183]:40571: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/access_tokens.db||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.8.106
description:
Jan 26 00:23:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-26 00:23:41 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:51258: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/CFIDE/administrator/images/componentutilslogin.jpg||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.42.79.74
description:
Jan 26 00:24:44 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.42.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-01-26 00:24:34 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:43734: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-26 00:25:14 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:4448: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: modsec
rule: 77318034
name: IM360 WAF: Blocked access to git folder
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Blocked access to git folder||RSV:6.65||T:APACHE||MV:/.git/l4reu4m3.php?id=javascript:alert(1)||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/cloudexp/application/configs/application.ini||User:lemsas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.42.79.74
description:
2025-01-26 00:24:46 dovecot_plain authenticator failed for ([206.42.79.74]) [206.42.79.74]:41482: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.idea/deployment.xml||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Jan 26 00:24:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 00:24:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.239.164.190
description:
Jan 26 00:25:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.239.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.164.190
description:
2025-01-26 00:25:08 dovecot_plain authenticator failed for (sogaz-gw.irkutsk.gldn.net) [195.239.164.190]:44201: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 26 00:25:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
description:
2025-01-26 00:26:10 dovecot_plain authenticator failed for ([116.132.42.170]) [116.132.42.170]:43776: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-26 00:25:36 dovecot_plain authenticator failed for ([94.43.224.106]) [2.57.219.2]:43396: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.199.89
description:
2025-01-26 00:25:37 dovecot_plain authenticator failed for ([112.102.199.89]) [112.102.199.89]:53602: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-01-26 00:25:50 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:43048: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.254.162
description:
2025-01-26 00:25:59 dovecot_plain authenticator failed for ([223.71.254.162]) [223.71.254.162]:45465: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-01-26 00:26:03 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:36618: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
description:
Jan 26 00:25:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Jan 26 00:25:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 00:25:34 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.bak||User:lemsas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Jan 26 00:25:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.42.170
description:
Jan 26 00:26:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.42.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-01-26 00:25:28 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:44910: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.6.25.115
description:
Jan 26 00:25:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.6.25.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.25.115
description:
2025-01-26 00:25:53 dovecot_plain authenticator failed for (static.rcn.com) [209.6.25.115]:46031: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
description:
2025-01-26 00:25:55 dovecot_plain authenticator failed for ([113.59.34.8]) [113.59.34.5]:49968: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Jan 26 00:26:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
description:
2025-01-26 00:25:35 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:49121: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
description:
Jan 26 00:26:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.184.53.83
description:
Jan 26 00:25:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.184.53.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
description:
2025-01-26 00:25:24 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:58578: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 26 00:25:34 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.199.89
description:
Jan 26 00:25:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.199.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.59.34.5
description:
Jan 26 00:25:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.59.34.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Jan 26 00:25:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.184.53.83
description:
2025-01-26 00:25:20 dovecot_plain authenticator failed for (default-rdns.vocus.co.nz) [203.184.53.83]:39103: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
description:
2025-01-26 00:25:20 dovecot_plain authenticator failed for ([60.14.36.47]) [60.14.36.47]:39622: 535 Incorrect authentication data (set_id=fusheini)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
description:
Jan 26 00:25:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
description:
Jan 26 00:25:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.254.162
description:
Jan 26 00:25:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-01-26 00:25:59 dovecot_plain authenticator failed for ([50.223.176.171]) [50.223.176.171]:45596: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-01-26 00:26:06 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:43295: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.196.189
description:
Jan 26 00:26:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.196.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.196.189
description:
2025-01-26 00:26:18 dovecot_plain authenticator failed for ([120.234.196.189]) [120.234.196.189]:47312: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 85.159.208.197
domain: lemsas.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/admin/configs/application.ini||User:lemsas||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/css/images/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
description:
Jan 26 00:28:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
description:
2025-01-26 00:28:02 dovecot_plain authenticator failed for (hoker) [65.20.233.110]:34145: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.167.139
description:
Jan 26 00:29:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.167.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.167.139
description:
2025-01-26 00:29:02 dovecot_plain authenticator failed for (abts-kk-static-139.167.166.122.airtelbroadband.in) [122.166.167.139]:35486: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 26 00:28:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-26 00:28:33 dovecot_plain authenticator failed for (mempasaric) [178.250.191.189]:56350: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
description:
2025-01-26 00:29:14 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:39837: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 00:28:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
description:
Jan 26 00:29:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Jan 26 00:29:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-01-26 00:29:50 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:59020: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Jan 26 00:30:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 178.79.150.252
domain: 136.243.145.84
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-01-26 00:30:07 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:37532: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 26 00:30:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-26 00:30:23 dovecot_plain authenticator failed for (hemated) [77.239.255.163]:44106: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/engine1/engine1/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
description:
Jan 26 00:32:06 ait sshd[1894069]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
description:
Jan 26 00:32:06 ait sshd[1894069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/css/images/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.71.191.43
description:
2025-01-26 00:32:41 dovecot_plain authenticator failed for ([1.71.191.42]) [1.71.191.43]:6998: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 00:32:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.223.68
description:
[2025-01-26 00:32:53 +0100] info [webmaild] 45.160.223.68 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Jan 26 00:33:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.71.191.43
description:
Jan 26 00:32:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.71.191.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-01-26 00:33:07 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:38576: 535 Incorrect authentication data (set_id=klah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/js/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.144.1
description:
[2025-01-26 00:32:32 +0100] info [webmaild] 177.137.144.1 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 00:33:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.206.193.131
description:
Jan 26 00:34:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.206.193.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Jan 26 00:33:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.95.84.68
description:
2025-01-26 00:33:39 dovecot_plain authenticator failed for static-185-95-84-68.sunucuhub.com [185.95.84.68]:52054: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 26 00:33:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-26 00:33:50 dovecot_plain authenticator failed for ([60.213.27.250]) [60.213.27.250]:37808: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-01-26 00:33:19 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:49376: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Jan 26 00:33:29 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Jan 26 00:34:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-01-26 00:34:12 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:53770: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/css/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-26 00:33:31 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:33396: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.95.84.68
description:
Jan 26 00:33:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.95.84.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.156.207
description:
[2025-01-26 00:34:36 +0100] info [webmaild] 45.229.156.207 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
description:
2025-01-26 00:35:15 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:51352: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
description:
2025-01-26 00:34:33 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:52830: 535 Incorrect authentication data (set_id=ofei)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/engine1/data1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Jan 26 00:34:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
description:
Jan 26 00:34:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Jan 26 00:34:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.206.193.131
description:
2025-01-26 00:34:18 dovecot_plain authenticator failed for host-37-206-193-131.business.telecomitalia.it [37.206.193.131]:59143: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-01-26 00:34:26 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:35273: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-01-26 00:34:42 dovecot_plain authenticator failed for ([158.140.38.21]) [158.140.38.21]:37464: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.79.195
description:
Jan 26 00:35:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.79.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.53.145
description:
[2025-01-26 00:34:25 +0100] info [webmaild] 170.78.53.145 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.186.33.55
description:
Jan 26 00:35:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.186.33.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.47
description:
2025-01-26 00:35:30 dovecot_plain authenticator failed for (holiake) [65.20.193.47]:44353: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.112.251
description:
[2025-01-26 00:35:35 +0100] info [webmaild] 176.29.112.251 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 26 00:35:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.159.61.251
description:
Jan 26 00:36:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.159.61.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.186.33.55
description:
2025-01-26 00:35:23 dovecot_plain authenticator failed for (h55.33.186.173.dynamic.ip.windstream.net) [173.186.33.55]:52070: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Jan 26 00:35:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.47
description:
Jan 26 00:35:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-01-26 00:36:07 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:36626: 535 Incorrect authentication data (set_id=rnunator)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/js/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.202.130
description:
[2025-01-26 00:35:29 +0100] info [webmaild] 45.231.202.130 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-01-26 00:35:53 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:52352: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-26 00:35:55 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:52303: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.61.251
description:
2025-01-26 00:36:03 dovecot_plain authenticator failed for (192-159-61-251.cst.watchcomm.net) [192.159.61.251]:53027: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
description:
Jan 26 00:36:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Jan 26 00:36:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.202
description:
Jan 26 00:37:11 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Jan 26 00:36:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.25.73
description:
2025-01-26 00:36:54 dovecot_plain authenticator failed for ([31.173.25.73]) [31.173.25.73]:50923: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 26 00:37:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Jan 26 00:36:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-26 00:37:10 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:42368: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.202
description:
2025-01-26 00:37:13 dovecot_plain authenticator failed for ([103.146.233.202]) [103.146.233.202]:51528: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.194
description:
Jan 26 00:36:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-01-26 00:36:58 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:34224: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-01-26 00:36:52 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:56172: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.25.73
description:
Jan 26 00:36:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.25.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-26 00:36:45 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:13406: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 26 00:37:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-01-26 00:36:41 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:55520: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 26 00:36:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-01-26 00:37:01 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:53672: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
description:
2025-01-26 00:36:33 dovecot_plain authenticator failed for (triolie) [65.20.148.194]:50704: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-26 00:37:09 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:51254: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Jan 26 00:36:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Jan 26 00:37:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-01-26 00:37:28 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:51693: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/data1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
description:
2025-01-26 00:38:40 dovecot_plain authenticator failed for ([220.172.203.43]) [220.172.203.43]:47878: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.237.145.18
description:
2025-01-26 00:39:02 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:13604: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 211.40.0.83
description:
Jan 26 00:39:11 ait sshd[1897363]: error: maximum authentication attempts exceeded for root from 211.40.0.83 port 34893 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.203.43
description:
Jan 26 00:38:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.203.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.40.0.83
description:
Jan 26 00:38:54 ait sshd[1897363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.40.0.83  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 26 00:39:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.238.90
description:
2025-01-26 00:39:56 dovecot_plain authenticator failed for ([122.187.147.17]) [128.185.238.90]:44708: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Jan 26 00:39:36 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
description:
2025-01-26 00:39:45 dovecot_plain authenticator failed for ([218.154.54.5]) [222.108.177.110]:51726: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.246.118.115
description:
Jan 26 00:39:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.246.118.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 26 00:40:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-01-26 00:39:38 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:21975: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.108.177.110
description:
Jan 26 00:39:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.108.177.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.238.90
description:
Jan 26 00:39:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.238.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.246.118.115
description:
2025-01-26 00:40:00 dovecot_plain authenticator failed for nz118l115.bb60246.ctm.net ([60.246.112.254]) [60.246.118.115]:42509: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 26 00:40:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-26 00:39:27 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:29095: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-26 00:40:04 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:36346: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-26 00:40:12 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:35602: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Jan 26 00:40:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Jan 26 00:40:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-01-26 00:40:45 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:54750: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 26 00:40:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.138.119.75
description:
Jan 26 00:40:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.138.119.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-26 00:40:43 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:39849: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-26 00:40:48 dovecot_plain authenticator failed for (pultsh) [102.53.15.17]:41960: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.68.89
description:
Jan 26 00:40:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.68.89
description:
2025-01-26 00:40:56 dovecot_plain authenticator failed for (abts-kk-static-89.68.166.122.airtelbroadband.in) [122.166.68.89]:44504: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.138.119.75
description:
2025-01-26 00:40:56 dovecot_plain authenticator failed for (75-119-138-120.mysipl.com) [120.138.119.75]:48750: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 26 00:41:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-26 00:41:26 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:53300: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 26 00:41:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-26 00:41:40 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:33598: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.221.252
description:
2025-01-26 00:41:43 dovecot_plain authenticator failed for ([210.104.221.252]) [210.104.221.252]:52698: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.222.13
description:
Jan 26 00:42:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.222.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.222.13
description:
2025-01-26 00:42:15 dovecot_plain authenticator failed for ([185.214.222.13]) [185.214.222.13]:42984: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Jan 26 00:41:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.104.221.252
description:
Jan 26 00:41:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.104.221.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-26 00:41:49 dovecot_plain authenticator failed for (eutly) [62.231.31.86]:48437: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 178.79.150.252
description:
178.79.150.252 - - [26/Jan/2025:00:41:24 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16940098 HTTP/1.1" 302 0 lemsas.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:178.79.150.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-26 00:41:27 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:52751: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 26 00:41:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-01-26 00:42:26 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:48010: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 00:42:34 ait sshd[1899234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 00:43:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.201.123.7
description:
Jan 26 00:43:09 ait sshd[1899428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.201.123.7  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
description:
Jan 26 00:42:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 00:42:34 ait sshd[1899234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.201.123.7
description:
Jan 26 00:43:09 ait sshd[1899428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.201.123.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.239.188.203
description:
2025-01-26 00:44:07 dovecot_plain authenticator failed for 203.sub-166-239-188.myvzw.com [166.239.188.203]:32530: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
description:
Jan 26 00:43:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
description:
Jan 26 00:43:28 ait sshd[1899909]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
description:
Jan 26 00:43:28 ait sshd[1899909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
description:
Jan 26 00:43:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
description:
2025-01-26 00:43:53 dovecot_plain authenticator failed for ([45.165.170.41]) [45.165.170.41]:55831: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.239.188.203
description:
Jan 26 00:44:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.239.188.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
description:
Jan 26 00:43:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-01-26 00:43:32 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:41100: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 26 00:44:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.201.123.7
description:
Jan 26 00:43:20 ait sshd[1899428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.201.123.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-01-26 00:43:23 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:54748: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 178.79.188.46
domain: ait.edu.gh
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/debug.log||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Jan 26 00:46:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 00:46:11 ait sshd[1901298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.0.156.128
description:
Jan 26 00:46:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.0.156.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.215.211.182
description:
Jan 26 00:45:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.215.211.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 26 00:45:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.220
description:
Jan 26 00:46:02 ait sshd[1901262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.220  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.174.38
description:
Jan 26 00:46:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.174.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.220
description:
2025-01-26 00:46:15 dovecot_plain authenticator failed for (jibshincy) [65.20.253.220]:35217: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.220
description:
Jan 26 00:46:02 ait sshd[1901262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-01-26 00:46:09 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:50236: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 00:46:11 ait sshd[1901298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.38
description:
2025-01-26 00:46:15 dovecot_plain authenticator failed for (phted) [65.20.174.38]:41219: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
description:
2025-01-26 00:46:17 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (quing) [90.0.156.128]:60926: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 178.79.188.46
domain: ait.edu.gh
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/uploads/dump.sql||User:ait02||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Jan 26 00:46:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 26 00:46:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 178.79.188.46
domain: ait.edu.gh
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/wp-content/uploads/dump.sql||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77350197
name: IM360 WAF: Essential Addons for Elementor < 5.7.2 - Vulnerable version discovery (CVE-2023-32243)
abuser: 178.79.188.46
domain: ait.edu.gh
description:
IM360 WAF: Essential Addons for Elementor < 5.7.2 - Vulnerable version discovery (CVE-2023-32243)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.216.244.102
description:
[2025-01-26 00:45:59 +0100] info [webmaild] 179.216.244.102 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 00:45:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 159.146.84.111
description:
[2025-01-26 00:45:49 +0100] info [webmaild] 159.146.84.111 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.220
description:
Jan 26 00:46:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
description:
Jan 26 00:46:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
description:
2025-01-26 00:46:49 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:42286: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Jan 26 00:46:55 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-01-26 00:46:57 dovecot_plain authenticator failed for ([82.208.99.163]) [82.208.99.163]:60438: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Jan 26 00:46:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-01-26 00:46:34 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:46424: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.229.19.81
description:
2025-01-26 00:47:34 dovecot_plain authenticator failed for ([45.229.19.81]) [45.229.19.81]:33318: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.142.43.74
description:
[2025-01-26 00:47:37 +0100] info [webmaild] 94.142.43.74 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.236
description:
Jan 26 00:47:39 ait sshd[1901870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-01-26 00:47:42 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:46154: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.130.12.1
description:
[2025-01-26 00:47:18 +0100] info [webmaild] 31.130.12.1 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
description:
Jan 26 00:47:39 ait sshd[1901870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Jan 26 00:47:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.229.19.81
description:
Jan 26 00:47:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.229.19.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Jan 26 00:49:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.163.103
description:
Jan 26 00:48:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.163.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Jan 26 00:48:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-01-26 00:48:40 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:34826: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 26 00:48:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-26 00:48:49 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:42002: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
description:
2025-01-26 00:48:27 dovecot_plain authenticator failed for (uvickled) [65.20.163.103]:42705: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-01-26 00:49:16 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:59260: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
description:
2025-01-26 00:49:59 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (gespoly) [5.228.154.62]:42366: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.226
description:
Jan 26 00:49:39 ait sshd[1902809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.226  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.110
description:
2025-01-26 00:50:03 dovecot_plain authenticator failed for (ebanapar) [65.20.251.110]:43607: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.50.14
description:
Jan 26 00:50:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.50.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.50.14
description:
2025-01-26 00:50:17 dovecot_plain authenticator failed for (ip-177-25-34-169.user.vivozap.com.br) [187.92.50.14]:51163: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 26 00:49:33 ait sshd[1902795]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 26 00:49:33 ait sshd[1902795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.110
description:
Jan 26 00:50:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Jan 26 00:50:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Jan 26 00:49:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-01-26 00:49:29 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:56629: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.226
description:
Jan 26 00:49:39 ait sshd[1902809]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
description:
Jan 26 00:49:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-01-26 00:50:08 dovecot_plain authenticator failed for (gomentient) [65.20.160.195]:58234: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.229
description:
Jan 26 00:50:56 ait sshd[1903512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.229  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
description:
Jan 26 00:50:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 00:50:29 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
description:
2025-01-26 00:50:29 dovecot_plain authenticator failed for ([58.115.53.66]) [58.115.53.66]:39603: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/engine1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.229
description:
Jan 26 00:50:56 ait sshd[1903512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.229
description:
Jan 26 00:51:20 ait sshd[1903623]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Jan 26 00:51:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-01-26 00:51:59 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:35237: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.229
description:
Jan 26 00:51:20 ait sshd[1903623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.229  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.141.127.152
description:
[2025-01-26 00:51:20 +0100] info [webmaild] 201.141.127.152 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Jan 26 00:51:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-01-26 00:51:49 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:47086: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.177.178.48
description:
[2025-01-26 00:51:55 +0100] info [webmaild] 191.177.178.48 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.6.212.190
description:
Jan 26 00:52:30 ait sshd[1904124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.212.190  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.151.142.219
description:
Jan 26 00:52:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.151.142.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.66
description:
Jan 26 00:52:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Jan 26 00:52:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-01-26 00:52:22 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:54552: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
description:
Jan 26 00:52:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
description:
2025-01-26 00:52:37 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:45776: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/engine1/images/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 26 00:52:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.66
description:
2025-01-26 00:52:49 dovecot_login authenticator failed for ([92.118.39.66]) [92.118.39.66]:53633: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 00:52:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.102.46.70
description:
[2025-01-26 00:53:02 +0100] info [webmaild] 190.102.46.70 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.151.142.219
description:
2025-01-26 00:52:48 dovecot_plain authenticator failed for c188-151-142-219.bredband.tele2.se (dicrurtery) [188.151.142.219]:44696: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-26 00:52:52 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (defra) [94.45.76.149]:48996: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-26 00:53:55 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:63338: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-26 00:53:58 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:45654: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 26 00:54:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Jan 26 00:53:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-01-26 00:53:28 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:54720: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
description:
Jan 26 00:53:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 26 00:53:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/engine1/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-01-26 00:53:42 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:34327: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
description:
2025-01-26 00:53:42 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:52384: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 26 00:53:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Jan 26 00:53:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-01-26 00:53:42 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:10918: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-26 00:54:05 dovecot_login authenticator failed for ([116.90.97.209]) [116.90.97.209]:57347: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
description:
Jan 26 00:53:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
description:
Jan 26 00:53:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
description:
2025-01-26 00:53:55 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:56174: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Jan 26 00:54:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-01-26 00:54:34 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:34180: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
description:
Jan 26 00:54:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-01-26 00:54:42 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:60745: 535 Incorrect authentication data (set_id=fusheini)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/css/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.97
description:
2025-01-26 00:55:49 dovecot_login authenticator failed for ([193.32.162.97]) [193.32.162.97]:60813: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.66
description:
2025-01-26 00:56:01 dovecot_login authenticator failed for ([193.32.162.66]) [193.32.162.66]:57901: 535 Incorrect authentication data (set_id=backup)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.83
description:
Jan 26 00:56:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.83
description:
2025-01-26 00:56:14 dovecot_login authenticator failed for ([193.32.162.83]) [193.32.162.83]:57459: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.81
description:
Jan 26 00:56:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.97
description:
Jan 26 00:55:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.66
description:
Jan 26 00:55:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.73
description:
Jan 26 00:56:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.73
description:
2025-01-26 00:56:10 dovecot_login authenticator failed for ([193.32.162.73]) [193.32.162.73]:56435: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-01-26 00:56:33 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:58344: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.181.210.18
description:
2025-01-26 00:56:49 dovecot_plain authenticator failed for ([216.181.210.18]) [216.181.210.18]:57266: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
description:
2025-01-26 00:56:55 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:38580: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/data1/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-26 00:56:37 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:59204: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
description:
2025-01-26 00:56:56 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:46670: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 26 00:57:03 ait sshd[1906654]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-01-26 00:56:43 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:60858: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.181.210.18
description:
Jan 26 00:56:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.181.210.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
description:
Jan 26 00:56:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 26 00:57:03 ait sshd[1906654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.81
description:
2025-01-26 00:56:17 dovecot_login authenticator failed for ([193.32.162.81]) [193.32.162.81]:55570: 535 Incorrect authentication data (set_id=fax)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
description:
2025-01-26 00:56:26 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:60574: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 26 00:56:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 26 00:56:36 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-26 00:56:38 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:58596: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Jan 26 00:56:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
description:
Jan 26 00:56:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Jan 26 00:56:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.181.1.49
description:
Jan 26 00:56:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.181.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-01-26 00:56:25 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:51299: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Jan 26 00:56:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
description:
2025-01-26 00:57:22 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:34761: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.56
description:
Jan 26 00:57:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.64.191
description:
Jan 26 00:58:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.64.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 26 00:58:11 ait sshd[1907145]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
description:
2025-01-26 00:58:11 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:41908: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
description:
Jan 26 00:57:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 00:57:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 26 00:58:11 ait sshd[1907145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 26 00:58:27 ait sshd[1907410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 26 00:58:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 00:58:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-26 00:58:51 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:53669: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.25.167.177
description:
2025-01-26 00:58:20 dovecot_plain authenticator failed for c-76-25-167-177.hsd1.co.comcast.net [76.25.167.177]:58550: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.25.167.177
description:
Jan 26 00:58:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.25.167.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 26 00:58:27 ait sshd[1907410]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.248.49
description:
Jan 26 00:59:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.248.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.248.49
description:
2025-01-26 00:59:29 dovecot_plain authenticator failed for ocs.novasys.coop (oxillaba) [92.222.248.49]:58550: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 00:59:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.149.220.145
description:
Jan 26 01:01:11 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.149.220.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-26 01:01:01 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:36716: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.59.244.125
description:
2025-01-26 01:01:08 dovecot_plain authenticator failed for ec2-13-59-244-125.us-east-2.compute.amazonaws.com (EC2AMAZ-K520ASL.us-east-2.compute.internal) [13.59.244.125]:52351: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.130
description:
2025-01-26 01:00:20 dovecot_plain authenticator failed for ([39.152.196.130]) [39.152.196.130]:58764: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 01:00:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/engine1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-01-26 01:00:33 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:55836: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 26 01:00:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.149.220.145
description:
2025-01-26 01:01:13 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.145]:57514: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/js/css/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 26 01:01:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 01:02:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 26 01:02:03 ait sshd[1909429]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 26 01:02:03 ait sshd[1909429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.235.247.80
description:
2025-01-26 01:02:04 dovecot_plain authenticator failed for ([91.235.247.80]) [91.235.247.80]:54172: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.59.244.125
description:
2025-01-26 01:01:21 dovecot_plain authenticator failed for ec2-13-59-244-125.us-east-2.compute.amazonaws.com (EC2AMAZ-K520ASL.us-east-2.compute.internal) [13.59.244.125]:52451: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.247.80
description:
Jan 26 01:02:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.247.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 01:01:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-26 01:01:54 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:51576: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 26 01:03:11 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-26 01:03:13 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:53230: 535 Incorrect authentication data (set_id=testuser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 01:02:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Jan 26 01:03:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-01-26 01:03:10 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:54698: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 26 01:02:28 ait sshd[1909536]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 26 01:02:28 ait sshd[1909536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/css/images/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Jan 26 01:03:19 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Jan 26 01:03:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-01-26 01:03:45 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:56302: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 01:04:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-01-26 01:03:21 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:47907: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Jan 26 01:03:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-01-26 01:03:35 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:34090: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.149.185
description:
Jan 26 01:04:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.149.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.149.185
description:
2025-01-26 01:04:48 dovecot_plain authenticator failed for ([120.237.149.185]) [120.237.149.185]:40166: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.231
description:
Jan 26 01:04:49 ait sshd[1910890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
description:
Jan 26 01:05:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
description:
2025-01-26 01:05:15 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:53088: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.231
description:
Jan 26 01:04:49 ait sshd[1910890]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Jan 26 01:04:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-01-26 01:05:01 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:40906: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.231.20
description:
2025-01-26 01:05:04 dovecot_plain authenticator failed for ([103.156.231.20]) [103.156.231.20]:58475: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-26 01:06:07 dovecot_plain authenticator failed for (ownderm) [62.231.31.86]:53651: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 26 01:05:44 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 01:06:02 ait sshd[1911877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-26 01:05:46 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:15345: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
description:
Jan 26 01:05:55 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
description:
2025-01-26 01:05:57 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:54260: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 01:06:02 ait sshd[1911877]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 26 01:06:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 26 01:06:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-26 01:06:56 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:38922: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 01:06:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/images/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
description:
Jan 26 01:06:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
description:
2025-01-26 01:06:49 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:3534: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Jan 26 01:07:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-01-26 01:07:05 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:54788: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
description:
Jan 26 01:07:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
description:
2025-01-26 01:07:15 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:52099: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Jan 26 01:07:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-01-26 01:07:18 dovecot_plain authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:40566: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/js/images/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 01:08:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.71.171.130
description:
2025-01-26 01:09:03 dovecot_plain authenticator failed for 69-71-171-130.mammothnetworks.com [69.71.171.130]:37059: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 01:09:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ablernes) [87.103.126.54]:12598: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.114
description:
Jan 26 01:08:18 ait sshd[1912802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.114  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/js/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.71.171.130
description:
Jan 26 01:09:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.71.171.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 01:09:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.114
description:
Jan 26 01:08:18 ait sshd[1912802]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-26 01:10:00 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net (thothorin) [51.77.193.92]:50006: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 26 01:09:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 26 01:09:46 ait sshd[1913636]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 26 01:09:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.127.177.194
description:
Jan 26 01:10:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.127.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.174.63
description:
Jan 26 01:10:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.174.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 26 01:09:46 ait sshd[1913636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-01-26 01:09:52 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:33583: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
description:
2025-01-26 01:10:02 dovecot_plain authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:46808: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
description:
2025-01-26 01:10:02 dovecot_plain authenticator failed for (coitenesis) [65.20.174.63]:35100: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-26 01:09:32 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:32808: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Jan 26 01:09:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/js/engine1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.242.251
description:
[2025-01-26 01:09:17 +0100] info [webmaild] 181.191.242.251 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.215.212.160
description:
2025-01-26 01:09:26 dovecot_plain authenticator failed for 218-215-212-160.sta.wbroadband.net.au [218.215.212.160]:34033: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 01:09:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.237.90
description:
Jan 26 01:11:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-01-26 01:10:31 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:37202: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
description:
2025-01-26 01:10:35 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:41091: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.237.90
description:
2025-01-26 01:11:02 dovecot_plain authenticator failed for (187-50-193-126.customer.tdatabrasil.net.br) [201.28.237.90]:38016: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 26 01:10:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-26 01:10:24 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:33948: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-01-26 01:11:12 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:40688: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Jan 26 01:11:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
description:
2025-01-26 01:10:19 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:5371: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Jan 26 01:10:29 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
description:
Jan 26 01:10:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
description:
Jan 26 01:10:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-01-26 01:11:44 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:34984: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Jan 26 01:11:42 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-01-26 01:11:33 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:50049: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Jan 26 01:11:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.14.195
description:
Jan 26 01:12:49 ait sshd[1915287]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.14.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.14.195
description:
Jan 26 01:12:49 ait sshd[1915287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.14.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Jan 26 01:12:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-01-26 01:12:37 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:48572: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 26 01:12:44 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-26 01:12:46 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:49640: 535 Incorrect authentication data (set_id=bsemaha)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/images/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.190.222.124
description:
Jan 26 01:13:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.190.222.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Jan 26 01:13:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-01-26 01:13:54 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:46990: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
description:
2025-01-26 01:14:07 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:37486: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
description:
2025-01-26 01:13:45 dovecot_plain authenticator failed for ([223.100.248.64]) [223.100.248.64]:47126: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.190.222.124
description:
2025-01-26 01:13:56 dovecot_plain authenticator failed for (94-190-222-124.static.imsbiz.com) [94.190.222.124]:58867: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 01:13:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
description:
Jan 26 01:13:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
description:
Jan 26 01:14:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Jan 26 01:14:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.227.80
description:
Jan 26 01:15:09 ait sshd[1916682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.130.227.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 26 01:14:45 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/css/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 26 01:15:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-26 01:15:02 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:39586: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
description:
Jan 26 01:15:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.217.91.98
description:
[2025-01-26 01:15:07 +0100] info [webmaild] 191.217.91.98 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
description:
2025-01-26 01:15:14 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:53748: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-26 01:14:47 dovecot_plain authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:35446: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-01-26 01:14:58 dovecot_plain authenticator failed for (200151009074.userdial.telemar.net.br) [200.151.9.74]:44006: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.130.227.80
description:
Jan 26 01:15:09 ait sshd[1916682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.130.227.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 01:16:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-26 01:15:50 dovecot_plain authenticator failed for (allian) [65.20.143.159]:51327: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Jan 26 01:15:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-01-26 01:15:53 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:49556: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/data1/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 26 01:15:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 01:16:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:51400: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Jan 26 01:16:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-26 01:16:45 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:53013: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.108.136.35
description:
Jan 26 01:17:07 ait sshd[1917724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.108.136.35


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.68.205
description:
Jan 26 01:16:36 ait sshd[1917471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.68.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.66.151.154
description:
2025-01-26 01:16:36 dovecot_plain authenticator failed for 154.151-66-87.adsl-dyn.isp.belgacom.be [87.66.151.154]:54906: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/js/images/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 26 01:16:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Jan 26 01:17:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-26 01:17:07 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:58634: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.108.136.35
description:
Jan 26 01:17:07 ait sshd[1917724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.108.136.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-01-26 01:16:30 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:27845: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.66.151.154
description:
Jan 26 01:16:34 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.66.151.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.68.205
description:
Jan 26 01:16:36 ait sshd[1917471]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.68.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 26 01:17:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-01-26 01:16:20 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:53766: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Jan 26 01:16:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-01-26 01:17:09 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:50636: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.253
description:
Jan 26 01:17:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-26 01:17:59 dovecot_plain authenticator failed for (enorbentry) [147.235.97.158]:55007: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 54.89.58.252
domain: ait.edu.gh
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/admin/.git/config||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.253
description:
2025-01-26 01:17:19 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:59157: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
description:
2025-01-26 01:17:24 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:46857: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
description:
Jan 26 01:17:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 01:17:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
description:
2025-01-26 01:18:10 dovecot_plain authenticator failed for 81-234-121-57-no600.tbcn.telia.com (dised) [81.234.121.57]:46384: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 01:17:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 26 01:17:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.234.121.57
description:
Jan 26 01:18:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.234.121.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.68.205
description:
Jan 26 01:18:40 ait sshd[1918499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.68.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.68.205
description:
Jan 26 01:18:40 ait sshd[1918499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.68.205


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/css/images/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.108.136.35
description:
Jan 26 01:18:45 ait sshd[1918520]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.108.136.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.108.136.35
description:
Jan 26 01:18:45 ait sshd[1918520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.108.136.35  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.14.195
description:
Jan 26 01:19:25 ait sshd[1918856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.14.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Jan 26 01:20:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.68.205
description:
Jan 26 01:19:54 ait sshd[1918978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.68.205


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/css/js/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.68.205
description:
Jan 26 01:19:56 ait sshd[1918978]: Failed password for invalid user ajay from 45.55.68.205 port 34750 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.14.195
description:
Jan 26 01:19:25 ait sshd[1918856]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.14.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.68.205
description:
Jan 26 01:19:54 ait sshd[1918978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.68.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-26 01:20:09 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:58301: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.82.122.234
description:
2025-01-26 01:20:26 dovecot_plain authenticator failed for ([59.93.107.33]) [119.82.122.234]:47156: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Jan 26 01:20:34 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-01-26 01:20:36 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:51736: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.108.136.35
description:
Jan 26 01:20:22 ait sshd[1919448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.108.136.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.82.122.234
description:
Jan 26 01:20:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.82.122.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.108.136.35
description:
Jan 26 01:20:22 ait sshd[1919448]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.108.136.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
description:
2025-01-26 01:20:46 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:47738: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/data1/images/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.208
description:
Jan 26 01:20:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.150
description:
Jan 26 01:20:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.193
description:
Jan 26 01:21:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.151.142.219
description:
Jan 26 01:20:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.151.142.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
description:
Jan 26 01:20:44 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-26 01:21:40 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (drazderew) [217.215.254.115]:41320: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/images/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.95.84.68
description:
Jan 26 01:21:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.95.84.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.193
description:
Jan 26 01:21:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.95.84.68
description:
2025-01-26 01:21:26 dovecot_plain authenticator failed for static-185-95-84-68.sunucuhub.com [185.95.84.68]:35922: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Jan 26 01:21:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/js/css/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 26 01:22:43 ait sshd[1920598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 26 01:22:43 ait sshd[1920598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 26 01:22:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-26 01:22:52 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:63216: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.247
description:
Jan 26 01:24:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Jan 26 01:23:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 26 01:23:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-26 01:23:34 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:39187: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Jan 26 01:23:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-01-26 01:23:52 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:50557: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-01-26 01:23:58 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:42707: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-26 01:24:00 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:16569: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-01-26 01:23:23 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:48936: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.247
description:
2025-01-26 01:24:08 dovecot_plain authenticator failed for ([76.77.25.247]) [76.77.25.247]:36928: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/js/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Jan 26 01:23:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 26 01:23:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.95.84.68
description:
2025-01-26 01:24:15 dovecot_login authenticator failed for static-185-95-84-68.sunucuhub.com [185.95.84.68]:35922: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
description:
2025-01-26 01:24:47 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:36804: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.19
description:
Jan 26 01:24:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-01-26 01:24:56 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:35822: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/js/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 26 01:24:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
description:
Jan 26 01:24:45 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Jan 26 01:25:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
description:
Jan 26 01:24:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-01-26 01:24:43 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:41718: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 26 01:24:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-26 01:25:09 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:7784: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-26 01:24:24 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (untinid) [51.255.84.180]:55538: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
description:
2025-01-26 01:24:43 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:51430: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-26 01:24:52 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:55372: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.19
description:
2025-01-26 01:24:53 dovecot_plain authenticator failed for ([121.202.153.19]) [121.202.153.19]:49665: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Jan 26 01:24:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 26 01:24:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-26 01:24:58 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:42671: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Jan 26 01:24:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.14.195
description:
Jan 26 01:25:21 ait sshd[1922120]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.14.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.14.195
description:
Jan 26 01:25:21 ait sshd[1922120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.14.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-26 01:26:06 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:63068: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 26 01:25:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-26 01:25:20 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:58680: 535 Incorrect authentication data (set_id=spam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/js/js/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 26 01:26:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-01-26 01:27:00 dovecot_plain authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:47861: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 154.161.159.106
domain: iric.us
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
description:
Jan 26 01:26:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.251.108.124
description:
Jan 26 01:26:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.251.108.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Jan 26 01:26:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 26 01:26:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-01-26 01:26:55 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:55631: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-26 01:27:05 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:34915: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.20.180
description:
Jan 26 01:27:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.20.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-01-26 01:26:33 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:33910: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-26 01:26:49 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:36410: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Jan 26 01:26:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-01-26 01:26:59 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:49844: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
description:
Jan 26 01:27:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
description:
Jan 26 01:26:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
description:
2025-01-26 01:26:20 dovecot_plain authenticator failed for ([45.251.108.124]) [45.251.108.124]:51215: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
description:
2025-01-26 01:26:43 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:52674: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.237.108
description:
Jan 26 01:27:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
description:
2025-01-26 01:27:12 dovecot_plain authenticator failed for ([218.22.237.108]) [218.22.237.108]:47015: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
description:
2025-01-26 01:27:05 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:56805: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 01:26:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Jan 26 01:26:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 26 01:27:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-01-26 01:27:30 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:54462: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.29.22
description:
47.128.29.22 - - [26/Jan/2025:01:27:29 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9071211 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/542172?panel=db" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/images/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.20.180
description:
2025-01-26 01:27:17 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:32867: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 154.161.159.106
domain: iric.us
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.118.8.9
description:
Jan 26 01:27:19 ait sshd[1923283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.118.8.9


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 01:27:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 98.159.236.215
description:
Jan 26 01:27:50 ait sshd[1923436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.159.236.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.118.8.9
description:
Jan 26 01:27:19 ait sshd[1923283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.118.8.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.159.236.215
description:
Jan 26 01:27:50 ait sshd[1923436]: pam_imunify(sshd:auth): [IM360_RBL] The IP 98.159.236.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Jan 26 01:27:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.80.130.229
description:
Jan 26 01:28:35 ait sshd[1923812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.80.130.229


plugin: ossec
rule: 11325
name: Active Response. Stealth SSHD brute force attack detected
abuser: 180.80.130.229
description:
Jan 26 01:28:51 ait sshd[1923812]: Failed password for invalid user ubnt from 180.80.130.229 port 43030 ssh2


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/css/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 01:28:31 ait sshd[1923803]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 01:28:31 ait sshd[1923803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.51.208.170
description:
Jan 26 01:28:52 ait sshd[1924000]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.51.208.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.51.208.170
description:
Jan 26 01:28:52 ait sshd[1924000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.51.208.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 26 01:29:42 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
description:
Jan 26 01:29:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.124.148
description:
Jan 26 01:30:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.124.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.222
description:
Jan 26 01:30:14 ait sshd[1924766]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.156.63.212
description:
Jan 26 01:30:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.156.63.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.222
description:
Jan 26 01:30:14 ait sshd[1924766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.222  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-26 01:30:16 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:9084: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 01:29:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
description:
2025-01-26 01:29:59 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:59144: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 26 01:30:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/js/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-26 01:29:44 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:27041: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.124.148
description:
2025-01-26 01:30:17 dovecot_login authenticator failed for ([121.66.124.148]) [121.66.124.148]:33533: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 01:30:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-26 01:30:54 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (switioning) [94.45.76.149]:57260: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-26 01:31:08 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (auspal) [195.159.217.71]:47946: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 26 01:31:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.63.212
description:
2025-01-26 01:30:17 dovecot_plain authenticator failed for ([202.156.63.212]) [202.156.63.212]:35386: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Jan 26 01:30:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.138.103
description:
2025-01-26 01:30:35 dovecot_plain authenticator failed for ([14.49.138.103]) [14.49.138.103]:36282: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-01-26 01:30:45 dovecot_login authenticator failed for ([60.247.92.186]) [60.247.92.186]:48614: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 26 01:30:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-01-26 01:30:54 dovecot_plain authenticator failed for (dynamicip-95-79-20-9.pppoe.nn.ertelecom.ru) [95.79.20.9]:56142: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.222
description:
Jan 26 01:30:18 ait sshd[1924766]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-01-26 01:30:28 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:52069: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 26 01:30:44 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-26 01:30:46 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:60333: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.222
description:
Jan 26 01:30:28 ait sshd[1924987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.222  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.138.103
description:
Jan 26 01:30:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.138.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Jan 26 01:30:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Jan 26 01:30:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Jan 26 01:31:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-01-26 01:31:35 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (triomod) [80.15.78.70]:56892: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 26 01:31:36 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 26 01:31:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-26 01:31:39 dovecot_plain authenticator failed for (broadband-37.204-237-3.ip.moscow.rt.ru) [37.204.237.3]:58238: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.33
description:
Jan 26 01:31:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.33
description:
2025-01-26 01:31:49 dovecot_plain authenticator failed for ([39.152.196.33]) [39.152.196.33]:38008: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.51.208.170
description:
Jan 26 01:31:57 ait sshd[1925724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.51.208.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.51.208.170
description:
Jan 26 01:31:57 ait sshd[1925724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.51.208.170


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.213.187.41
description:
Jan 26 01:32:08 ait sshd[1925754]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.213.187.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.213.187.41
description:
Jan 26 01:32:08 ait sshd[1925754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.213.187.41


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-26 01:31:38 dovecot_plain authenticator failed for (untrity) [102.53.15.17]:45784: 535 Incorrect authentication data (set_id=ait.edu.gh@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
description:
Jan 26 01:32:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
description:
2025-01-26 01:32:51 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:34285: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.226.153.1
description:
2025-01-26 01:33:01 dovecot_plain authenticator failed for ([160.226.153.1]) [160.226.153.1]:49149: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
description:
Jan 26 01:33:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.128.254.210
description:
Jan 26 01:32:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.128.254.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
description:
Jan 26 01:33:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.159.236.215
description:
Jan 26 01:32:30 ait sshd[1926044]: pam_imunify(sshd:auth): [IM360_RBL] The IP 98.159.236.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.130.238
description:
Jan 26 01:32:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.130.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-26 01:32:51 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:35975: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-26 01:33:15 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:24279: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 26 01:32:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 26 01:33:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
description:
2025-01-26 01:33:15 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:55203: 535 Incorrect authentication data (set_id=assdas4)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 98.159.236.215
description:
Jan 26 01:32:30 ait sshd[1926044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.159.236.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.226.153.1
description:
Jan 26 01:32:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.226.153.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.51.208.170
description:
Jan 26 01:33:25 ait sshd[1926413]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.51.208.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.51.208.170
description:
Jan 26 01:33:25 ait sshd[1926413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.51.208.170


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/js/images/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-26 01:34:00 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:60044: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.159.236.215
description:
Jan 26 01:34:11 ait sshd[1926826]: pam_imunify(sshd:auth): [IM360_RBL] The IP 98.159.236.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.20.15.167
description:
Jan 26 01:34:11 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.20.15.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 98.159.236.215
description:
Jan 26 01:34:11 ait sshd[1926826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.159.236.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.20.15.167
description:
2025-01-26 01:34:13 dovecot_plain authenticator failed for ([60.20.15.167]) [60.20.15.167]:39002: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.217.86
description:
Jan 26 01:33:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.217.86 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.208.170
description:
Jan 26 01:33:27 ait sshd[1926413]: Failed password for invalid user es from 202.51.208.170 port 41575 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
description:
2025-01-26 01:33:27 dovecot_plain authenticator failed for ([183.167.217.86]) [183.167.217.86]:56878: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 26 01:33:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 26 01:33:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 26 01:34:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
description:
Jan 26 01:34:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.113.86.201
description:
Jan 26 01:34:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.113.86.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 26 01:34:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-26 01:34:22 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com (allingery) [46.162.74.47]:62937: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
description:
Jan 26 01:34:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-26 01:34:20 dovecot_plain authenticator failed for mail.schindler-statik.at (reddria) [80.120.186.246]:42946: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.113.86.201
description:
2025-01-26 01:34:53 dovecot_plain authenticator failed for 88-113-86-201.elisa-laajakaista.fi (gorpuf) [88.113.86.201]:57600: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.214.226
description:
2025-01-26 01:34:58 dovecot_plain authenticator failed for (broadband.actcorp.in) [115.245.214.226]:34520: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/js/engine1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
description:
2025-01-26 01:34:33 dovecot_plain authenticator failed for ([61.184.176.231]) [61.184.176.231]:54833: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 01:34:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 01:34:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-26 01:35:50 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:35090: 535 Incorrect authentication data (set_id=dgyan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
description:
Jan 26 01:35:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Jan 26 01:36:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 26 01:35:31 ait sshd[1927695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 01:35:44 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.211
description:
2025-01-26 01:35:37 dovecot_login authenticator failed for ([195.178.110.211]) [195.178.110.211]:59259: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
description:
Jan 26 01:36:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.63.225.184
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-36.178.63.225.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
description:
Jan 26 01:36:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 26 01:35:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
description:
2025-01-26 01:36:06 dovecot_plain authenticator failed for ([116.114.84.170]) [116.114.84.170]:50717: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.211
description:
Jan 26 01:35:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-26 01:36:15 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:50271: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 26 01:36:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 26 01:35:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-26 01:35:22 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:44136: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 26 01:35:31 ait sshd[1927695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 26 01:35:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
description:
2025-01-26 01:35:33 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:49683: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-26 01:35:41 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:52569: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-01-26 01:36:15 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:60344: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
description:
2025-01-26 01:36:28 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:49691: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.110.127.224
description:
2025-01-26 01:36:34 dovecot_plain authenticator failed for ([183.71.251.66]) [14.110.127.224]:38176: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 01:36:51 ait sshd[1928296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 01:36:51 ait sshd[1928296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
description:
2025-01-26 01:36:59 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:43698: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 26 01:37:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.126.186.104
description:
2025-01-26 01:36:24 dovecot_plain authenticator failed for ([129.126.186.104]) [129.126.186.104]:56425: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.110.127.224
description:
Jan 26 01:36:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.110.127.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.128.5
description:
Jan 26 01:36:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.128.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-01-26 01:37:12 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:37806: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Jan 26 01:37:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.0.78.32
description:
Jan 26 01:36:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.0.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.0.78.32
description:
2025-01-26 01:36:56 dovecot_login authenticator failed for fl-71-0-78-32.dhcp.embarqhsd.net [71.0.78.32]:34302: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Jan 26 01:37:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-01-26 01:37:16 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:48752: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-26 01:37:10 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:52162: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
description:
2025-01-26 01:36:18 dovecot_plain authenticator failed for ([45.165.170.41]) [45.165.170.41]:44752: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.186.104
description:
Jan 26 01:36:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.186.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
description:
Jan 26 01:36:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.168.80
description:
Jan 26 01:36:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.168.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.168.80
description:
2025-01-26 01:36:55 dovecot_plain authenticator failed for ([181.189.168.80]) [181.189.168.80]:48766: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 26 01:37:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 01:37:33 ait sshd[1928613]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 26 01:37:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 26 01:38:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.176.41.40
description:
Jan 26 01:37:21 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.176.41.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 26 01:37:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-26 01:37:29 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (herestic) [89.153.62.100]:45618: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-01-26 01:37:35 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:53444: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-01-26 01:37:53 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:51677: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-26 01:37:19 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:33705: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.118.8.9
description:
Jan 26 01:37:22 ait sshd[1928424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.118.8.9


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.41.40
description:
2025-01-26 01:37:23 dovecot_plain authenticator failed for ([178.176.41.40]) [178.176.41.40]:35671: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 01:37:33 ait sshd[1928613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 01:37:34 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.199.20
description:
Jan 26 01:37:38 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.199.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-26 01:37:52 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:45990: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.118.8.9
description:
Jan 26 01:37:22 ait sshd[1928424]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.118.8.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Jan 26 01:37:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.199.20
description:
2025-01-26 01:37:40 dovecot_plain authenticator failed for ([157.122.199.20]) [157.122.199.20]:37130: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Jan 26 01:37:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-26 01:38:08 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:56750: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Jan 26 01:38:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.118.8.9
description:
Jan 26 01:38:51 ait sshd[1929061]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.118.8.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.118.8.9
description:
Jan 26 01:38:51 ait sshd[1929061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.118.8.9


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.93.229.230
description:
2025-01-26 01:38:52 dovecot_plain authenticator failed for ([218.93.229.230]) [218.93.229.230]:55282: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.50.14
description:
2025-01-26 01:38:52 dovecot_plain authenticator failed for (201-91-49-72.customer.tdatabrasil.net.br) [187.92.50.14]:46051: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
description:
Jan 26 01:39:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-01-26 01:39:14 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:43588: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-01-26 01:38:24 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:45603: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Jan 26 01:39:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 154.161.159.106
domain: iric.us
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=50&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-01-26 01:38:35 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:52579: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.93.229.230
description:
Jan 26 01:38:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.93.229.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Jan 26 01:39:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
description:
2025-01-26 01:39:08 dovecot_plain authenticator failed for ([178.178.194.135]) [178.178.194.135]:35210: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-01-26 01:39:08 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:50018: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Jan 26 01:38:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Jan 26 01:39:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.50.14
description:
Jan 26 01:38:50 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.50.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 26 01:38:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-26 01:39:01 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:36625: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.151.194
description:
Jan 26 01:39:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.151.194 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.97.115
description:
47.128.97.115 - - [26/Jan/2025:01:39:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22127809 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=847" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.97.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 01:38:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 26 01:40:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.151.194
description:
2025-01-26 01:39:19 dovecot_plain authenticator failed for ([187.6.151.177]) [187.6.151.194]:44498: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-01-26 01:39:19 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:53214: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 01:39:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-26 01:40:10 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:59368: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.88.64.163
description:
Jan 26 01:40:42 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.88.64.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.64.163
description:
2025-01-26 01:40:44 dovecot_plain authenticator failed for ([222.88.64.163]) [222.88.64.163]:41783: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.52.253.175
description:
2025-01-26 01:40:49 dovecot_plain authenticator failed for ([111.52.253.175]) [111.52.253.175]:48040: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.230.86
description:
Jan 26 01:40:34 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.230.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 01:40:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 26 01:40:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-26 01:41:03 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (sares) [54.38.80.107]:54378: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.162
description:
Jan 26 01:41:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-26 01:40:22 dovecot_plain authenticator failed for ([218.22.187.70]) [218.22.187.66]:55459: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-26 01:40:34 dovecot_plain authenticator failed for (broadband-37.204-237-3.ip.moscow.rt.ru) [37.204.237.3]:55260: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
description:
2025-01-26 01:40:36 dovecot_plain authenticator failed for ([218.92.230.86]) [218.92.230.86]:57213: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.52.253.175
description:
Jan 26 01:40:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.52.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Jan 26 01:40:59 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 26 01:41:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-01-26 01:41:01 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:40732: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.138.162
description:
2025-01-26 01:41:12 dovecot_plain authenticator failed for (201-91-242-196.customer.tdatabrasil.net.br) [201.63.138.162]:54431: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 26 01:40:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 26 01:40:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-26 01:42:00 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:50347: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Jan 26 01:42:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-01-26 01:42:09 dovecot_plain authenticator failed for ([60.31.249.131]) [60.31.249.131]:38001: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.239.186
description:
Jan 26 01:41:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.239.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 26 01:41:43 ait sshd[1930657]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 26 01:41:43 ait sshd[1930657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Jan 26 01:41:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 26 01:43:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Jan 26 01:43:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-01-26 01:43:54 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:49614: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
description:
Jan 26 01:44:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-26 01:43:45 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (pitraddil) [51.255.84.180]:53230: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Jan 26 01:43:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Jan 26 01:44:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-01-26 01:44:06 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:27023: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.219
description:
Jan 26 01:44:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-01-26 01:43:56 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:33964: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 26 01:44:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-26 01:44:06 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:4745: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.219
description:
2025-01-26 01:44:12 dovecot_plain authenticator failed for ([60.31.181.219]) [60.31.181.219]:38620: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
description:
2025-01-26 01:44:16 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:58378: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.253.77
description:
Jan 26 01:43:48 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.253.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.253.77
description:
2025-01-26 01:43:50 dovecot_plain authenticator failed for (unmegad) [185.254.253.77]:44699: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Jan 26 01:44:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-01-26 01:44:56 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:41451: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
description:
2025-01-26 01:45:04 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:40247: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.83.144.189
description:
[2025-01-26 01:44:51 +0100] info [webmaild] 177.83.144.189 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 26 01:44:58 ait sshd[1932290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 26 01:44:58 ait sshd[1932290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
description:
Jan 26 01:45:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.20.130
description:
Jan 26 01:46:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.20.130
description:
2025-01-26 01:46:10 dovecot_login authenticator failed for ([60.11.20.130]) [60.11.20.130]:48348: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-26 01:46:18 dovecot_plain authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:37710: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.139.50
description:
Jan 26 01:46:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.139.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.139.50
description:
2025-01-26 01:46:25 dovecot_login authenticator failed for ([218.206.139.50]) [218.206.139.50]:58951: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.148
description:
2025-01-26 01:46:25 dovecot_login authenticator failed for ([216.126.65.148]) [216.126.65.148]:44370: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.171.186
description:
Jan 26 01:45:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.171.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
description:
2025-01-26 01:46:00 dovecot_plain authenticator failed for ([183.247.171.186]) [183.247.171.186]:58693: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 26 01:46:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.126.65.148
description:
Jan 26 01:46:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.126.65.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 26 01:46:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-26 01:46:39 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:57925: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-01-26 01:47:54 dovecot_plain authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:55140: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.231.20
description:
Jan 26 01:47:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.231.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.231.20
description:
2025-01-26 01:47:41 dovecot_plain authenticator failed for ([103.156.231.20]) [103.156.231.20]:59046: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 26 01:47:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-26 01:47:49 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (patiouk) [195.159.217.71]:51180: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Jan 26 01:47:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.213.84.235
description:
Jan 26 01:49:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.213.84.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.213.84.235
description:
2025-01-26 01:49:16 dovecot_plain authenticator failed for (thried) [156.213.84.235]:28799: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 01:49:19 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 01:49:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 26 01:51:17 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-26 01:51:19 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:47590: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/images/css/images/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.95.97.158
description:
Jan 26 01:51:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.95.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.95.97.158
description:
2025-01-26 01:51:09 dovecot_plain authenticator failed for ([180.166.163.26]) [101.95.97.158]:54572: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/engine1/data1/images/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 01:51:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/engine1/images/images/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 01:52:37 ait sshd[1936022]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 01:52:37 ait sshd[1936022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 26 01:52:30 ait sshd[1935990]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 26 01:52:30 ait sshd[1935990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/engine1/images/images/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.7.51.11
description:
Jan 26 01:54:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.7.51.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.7.51.11
description:
2025-01-26 01:54:20 dovecot_plain authenticator failed for ([50.255.70.90]) [12.7.51.11]:50979: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.245.27
description:
2025-01-26 01:54:32 dovecot_plain authenticator failed for ([211.193.245.27]) [211.193.245.27]:54099: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/js/js/data1/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
description:
2025-01-26 01:54:58 dovecot_login authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:46706: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.182.90.67
description:
2025-01-26 01:55:02 dovecot_login authenticator failed for ([107.182.90.67]) [107.182.90.67]:52452: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Jan 26 01:55:09 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.245.27
description:
Jan 26 01:54:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.245.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-01-26 01:55:08 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (subtul) [80.15.78.70]:52879: 535 Incorrect authentication data (set_id=ait.edu.gh@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-01-26 01:55:11 dovecot_login authenticator failed for ([121.174.189.52]) [121.174.189.52]:51876: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 26 01:55:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
description:
Jan 26 01:54:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.182.90.67
description:
Jan 26 01:55:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.182.90.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Jan 26 01:55:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-26 01:55:14 dovecot_login authenticator failed for ([200.141.225.73]) [200.149.54.14]:33124: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 26 01:56:24 ait sshd[1938100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 26 01:56:24 ait sshd[1938100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/js/js/css/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 01:56:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
description:
2025-01-26 01:57:06 dovecot_login authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:38136: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.227.218
description:
2025-01-26 01:56:53 dovecot_login authenticator failed for ([106.246.227.218]) [106.246.227.218]:57210: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
description:
Jan 26 01:57:03 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
description:
Jan 26 01:57:04 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
description:
2025-01-26 01:57:05 dovecot_login authenticator failed for ([73.231.102.189]) [73.231.102.189]:50922: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
description:
Jan 26 01:57:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 01:57:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
description:
2025-01-26 01:57:14 dovecot_login authenticator failed for ([45.65.68.104]) [45.65.68.104]:59290: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/js/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.227.218
description:
Jan 26 01:56:51 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.227.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/js/images/data1/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Jan 26 01:57:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.158
description:
2025-01-26 01:57:54 dovecot_login authenticator failed for ([217.22.37.158]) [217.22.37.158]:36815: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.123.122.103
description:
Jan 26 01:57:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.123.122.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.185.229.127
description:
2025-01-26 01:58:09 dovecot_login authenticator failed for ([109.185.229.127]) [109.185.229.127]:2306: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-26 01:58:09 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:17687: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.193.199.39
description:
Jan 26 01:58:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.193.199.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
description:
Jan 26 01:58:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.193.199.39
description:
2025-01-26 01:58:14 dovecot_login authenticator failed for ([221.193.199.39]) [221.193.199.39]:41626: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Jan 26 01:58:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.252.18.246
description:
Jan 26 01:58:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.252.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 26 01:58:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.89
description:
Jan 26 01:57:42 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.155
description:
2025-01-26 01:57:51 dovecot_login authenticator failed for ([166.195.195.155]) [166.195.195.155]:41097: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.185.229.127
description:
Jan 26 01:58:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.185.229.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
description:
Jan 26 01:58:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
description:
2025-01-26 01:58:22 dovecot_login authenticator failed for ([58.18.88.146]) [58.18.88.146]:54965: 535 Incorrect authentication data (set_id=eng20a00114y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.158
description:
Jan 26 01:57:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.123.122.103
description:
2025-01-26 01:57:58 dovecot_login authenticator failed for ([113.125.111.68]) [42.123.122.103]:45340: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.48.53
description:
2025-01-26 01:58:14 dovecot_login authenticator failed for ([103.144.48.53]) [103.144.48.53]:54611: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 01:58:26 ait sshd[1938918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.14.179.108
description:
2025-01-26 01:57:45 dovecot_plain authenticator failed for ([59.14.179.108]) [59.14.179.108]:46856: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
description:
2025-01-26 01:58:24 dovecot_login authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:59526: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-01-26 01:58:27 dovecot_login authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:58488: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.14.179.108
description:
Jan 26 01:57:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.14.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
description:
2025-01-26 01:57:56 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:40057: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.89
description:
2025-01-26 01:57:44 dovecot_login authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:51128: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.155
description:
Jan 26 01:57:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.144.48.53
description:
Jan 26 01:58:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.144.48.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 01:58:26 ait sshd[1938918]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.96.160.35
description:
Jan 26 01:58:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.96.160.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 26 01:59:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.149.173.90
description:
Jan 26 01:59:19 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.149.173.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-26 01:58:45 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:58076: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-26 01:59:13 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:54828: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-26 01:59:10 dovecot_login authenticator failed for ([211.109.75.66]) [211.109.75.69]:58764: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/js/js/js/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 26 01:58:43 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.96.160.35
description:
2025-01-26 01:58:55 dovecot_login authenticator failed for ([211.96.160.35]) [211.96.160.35]:37059: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 26 01:59:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.165.230
description:
Jan 26 01:59:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.165.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.165.230
description:
2025-01-26 01:59:16 dovecot_login authenticator failed for ([183.237.165.230]) [183.237.165.230]:39155: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.252.18.246
description:
2025-01-26 01:58:29 dovecot_login authenticator failed for ([162.252.18.246]) [162.252.18.246]:58788: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Jan 26 01:58:57 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-01-26 01:58:59 dovecot_login authenticator failed for ([180.188.139.189]) [180.188.139.189]:48505: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-26 01:59:03 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:25561: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
description:
2025-01-26 01:59:08 dovecot_login authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:59254: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 26 01:59:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 26 01:58:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
description:
2025-01-26 01:58:58 dovecot_login authenticator failed for ([120.194.50.39]) [120.194.50.39]:53608: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-26 01:59:18 dovecot_login authenticator failed for ([218.149.70.142]) [218.149.70.142]:41218: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-01-26 01:58:43 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:43094: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Jan 26 01:58:41 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 26 01:59:01 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
description:
Jan 26 01:59:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 26 01:58:29 ait sshd[1938918]: Failed password for invalid user ijari from 210.180.118.166 port 58686 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-26 01:59:00 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:40614: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.71.191.43
description:
Jan 26 01:59:06 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.71.191.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 26 01:59:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.227
description:
Jan 26 01:59:12 ait sshd[1939275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.227
description:
Jan 26 01:59:12 ait sshd[1939275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.227  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-26 01:59:14 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:47740: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-26 01:59:15 dovecot_login authenticator failed for ([58.42.226.215]) [58.42.226.215]:45246: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.214
description:
Jan 26 01:58:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
description:
Jan 26 01:58:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.71.191.43
description:
2025-01-26 01:59:08 dovecot_login authenticator failed for ([1.71.191.42]) [1.71.191.43]:57534: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 26 01:59:11 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.149.173.90
description:
2025-01-26 01:59:21 dovecot_login authenticator failed for ([117.149.173.90]) [117.149.173.90]:40480: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Jan 26 01:59:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-26 01:58:33 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:58857: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
description:
2025-01-26 02:00:15 dovecot_login authenticator failed for ([211.193.37.116]) [211.193.37.116]:37400: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-26 01:59:29 dovecot_login authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:43753: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.46.114
description:
Jan 26 01:59:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.46.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.36.188
description:
Jan 26 01:59:54 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.36.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.36.188
description:
2025-01-26 01:59:56 dovecot_login authenticator failed for ([210.21.36.188]) [210.21.36.188]:46493: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-26 02:00:10 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:39058: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
description:
Jan 26 02:00:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.249.252
description:
Jan 26 02:00:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.249.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.46.114
description:
2025-01-26 01:59:55 dovecot_login authenticator failed for ([125.20.46.114]) [125.20.46.114]:54504: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Jan 26 02:00:19 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-01-26 02:00:21 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:51465: 535 Incorrect authentication data (set_id=edonkor)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/js/js/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
description:
2025-01-26 01:59:41 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:52265: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Jan 26 01:59:53 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-01-26 01:59:55 dovecot_login authenticator failed for ([123.142.230.50]) [123.142.230.50]:34946: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
description:
2025-01-26 02:00:27 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:33316: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 26 01:59:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
description:
2025-01-26 01:59:29 dovecot_login authenticator failed for ([110.189.153.136]) [110.189.153.136]:58322: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
description:
Jan 26 01:59:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 26 02:00:08 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.125.200
description:
Jan 26 02:00:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.204.162.110
description:
2025-01-26 02:00:48 dovecot_login authenticator failed for ([218.204.162.110]) [218.204.162.110]:52064: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.20
description:
Jan 26 02:01:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 26 02:01:24 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.249.252
description:
2025-01-26 02:00:29 dovecot_login authenticator failed for p93252-obmd01.tokyo.ocn.ne.jp [124.101.249.252]:59912: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.59.211.214
description:
Jan 26 02:00:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.59.211.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-26 02:01:00 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:40908: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.20
description:
2025-01-26 02:01:07 dovecot_login authenticator failed for (201.218.181.20.viptel.com) [201.218.181.20]:39156: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-26 02:01:26 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:60071: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.59.211.214
description:
2025-01-26 02:00:39 dovecot_login authenticator failed for ([201.59.211.214]) [201.59.211.214]:42304: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.204.162.110
description:
Jan 26 02:00:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.204.162.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 26 02:00:58 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.148.248.242
description:
Jan 26 02:00:28 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.148.248.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.148.248.242
description:
2025-01-26 02:00:30 dovecot_login authenticator failed for ([117.148.248.242]) [117.148.248.242]:58768: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 26 02:01:15 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-26 02:01:17 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:36108: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 26 02:01:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-26 02:01:35 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:40078: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 02:02:22 ait sshd[1940960]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 02:02:22 ait sshd[1940960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/engine1/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/data1/images/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 02:03:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 02:03:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/js/data1/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.68.62
description:
Jan 26 02:04:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.68.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.68.62
description:
2025-01-26 02:04:24 dovecot_plain authenticator failed for (colon) [194.87.68.62]:46394: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.63
description:
Jan 26 02:04:25 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-01-26 02:04:51 dovecot_plain authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:38265: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
description:
2025-01-26 02:04:27 dovecot_plain authenticator failed for (inglats) [65.20.250.63]:55468: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 26 02:04:37 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-26 02:04:39 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:57810: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Jan 26 02:04:49 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/images/data1/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 26 02:06:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 02:06:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-26 02:06:22 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:49624: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 02:05:36 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.215
description:
2025-01-26 02:06:42 dovecot_login authenticator failed for ([195.178.110.215]) [195.178.110.215]:61750: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 26 02:06:31 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 02:06:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-26 02:06:33 dovecot_plain authenticator failed for (skiss) [178.250.191.189]:34648: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
description:
2025-01-26 02:06:34 dovecot_login authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:51066: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.215
description:
Jan 26 02:06:40 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/data1/images/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
description:
Jan 26 02:06:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 26 02:07:27 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/engine1/data1/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 26 02:08:07 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-26 02:08:09 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:60355: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-26 02:07:29 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (unsemien) [51.255.84.180]:58724: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 02:07:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.117.179
description:
Jan 26 02:08:16 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.117.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.117.179
description:
2025-01-26 02:08:18 dovecot_plain authenticator failed for (abts-mum-static-179.117.70.182.airtelbroadband.in) [182.70.117.179]:38019: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 26 02:08:22 ait sshd[1943949]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 26 02:08:22 ait sshd[1943949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
description:
Jan 26 02:09:14 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
description:
2025-01-26 02:09:16 dovecot_login authenticator failed for ([183.253.125.205]) [183.253.125.205]:53261: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-01-26 02:09:22 dovecot_login authenticator failed for ([121.174.189.52]) [121.174.189.52]:49800: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.47.157
description:
Jan 26 02:09:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.47.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
description:
Jan 26 02:09:02 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
description:
2025-01-26 02:09:02 dovecot_login authenticator failed for ([58.22.255.28]) [58.22.255.28]:39013: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.47.157
description:
2025-01-26 02:09:02 dovecot_login authenticator failed for ([222.116.47.157]) [222.116.47.157]:52253: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
description:
2025-01-26 02:09:04 dovecot_login authenticator failed for ([121.202.155.16]) [121.202.155.16]:6950: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
description:
Jan 26 02:09:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
description:
2025-01-26 02:09:12 dovecot_login authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:38380: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Jan 26 02:09:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
description:
Jan 26 02:09:00 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.51.211
description:
2025-01-26 02:09:32 dovecot_login authenticator failed for ([5.59.51.211]) [5.59.51.211]:59982: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-01-26 02:09:46 dovecot_login authenticator failed for ([62.28.66.78]) [62.28.66.78]:57541: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 02:10:26 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.51.211
description:
Jan 26 02:09:30 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.51.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.56
description:
Jan 26 02:09:35 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-26 02:09:35 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:46574: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.56
description:
2025-01-26 02:09:37 dovecot_login authenticator failed for ([157.122.198.56]) [157.122.198.56]:38895: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Jan 26 02:09:44 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 02:10:20 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 26 02:10:22 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 26 02:09:33 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/engine1/js/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 26 02:11:23 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-26 02:11:25 dovecot_plain authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:45218: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
description:
2025-01-26 02:12:20 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:55711: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-26 02:11:41 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:42082: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/images/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Jan 26 02:11:56 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-01-26 02:11:58 dovecot_login authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:46300: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.60.186
description:
Jan 26 02:12:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.60.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 26 02:11:39 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 02:11:47 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.139.177.171
description:
Jan 26 02:13:05 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.139.177.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/engine1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 26 02:14:08 ait sshd[1946693]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 26 02:14:08 ait sshd[1946693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/css/js/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 02:14:02 ait sshd[1946519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 02:14:02 ait sshd[1946519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/css/engine1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Jan 26 02:14:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-01-26 02:14:54 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:43154: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 26 02:15:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.189
description:
Jan 26 02:15:12 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-26 02:15:12 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:57540: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.189
description:
2025-01-26 02:15:14 dovecot_plain authenticator failed for (heaed) [65.20.147.189]:40251: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/engine1/css/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 26 02:16:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 26 02:15:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-26 02:16:12 dovecot_plain authenticator failed for (anscepite) [102.53.15.18]:57244: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-26 02:15:34 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:35508: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 02:15:52 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 02:17:19 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/css/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.212
description:
Jan 26 02:18:10 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.212
description:
2025-01-26 02:18:12 dovecot_login authenticator failed for ([195.178.110.212]) [195.178.110.212]:53657: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.123.236.52
description:
Jan 26 02:18:18 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.123.236.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.123.236.52
description:
2025-01-26 02:18:20 dovecot_plain authenticator failed for syn-070-123-236-052.res.spectrum.com [70.123.236.52]:47364: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/engine1/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
description:
2025-01-26 02:18:34 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:36886: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/engine1/css/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.181.1.49
description:
Jan 26 02:18:32 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.181.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-01-26 02:19:48 dovecot_plain authenticator failed for (sychis) [62.73.121.209]:36579: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/css/images/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Jan 26 02:19:46 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.12
description:
Jan 26 02:21:13 ait auth[1852089]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
description:
2025-01-26 02:21:15 dovecot_plain authenticator failed for (nonaings) [65.20.191.12]:45311: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.83
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/engine1/images/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


