# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-01-28 18:40:37 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:3632: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Jan 28 18:40:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.61.104
description:
47.128.61.104 - - [28/Jan/2025:18:39:51 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16698798 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/data/map14.php" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.61.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Jan 28 18:40:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
description:
Jan 28 18:40:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.95
description:
[2025-01-28 18:40:52 +0100] info [whostmgrd] 156.228.78.95 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.158
description:
[2025-01-28 18:40:54 +0100] info [whostmgrd] 156.228.81.158 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 28 18:41:40 ait sshd[3829427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.13
description:
[2025-01-28 18:40:49 +0100] info [cpaneld] 156.228.96.13 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.186
description:
[2025-01-28 18:40:51 +0100] info [whostmgrd] 104.207.63.186 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.51
description:
[2025-01-28 18:40:51 +0100] info [whostmgrd] 104.207.63.51 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.97
description:
[2025-01-28 18:40:50 +0100] info [whostmgrd] 104.207.32.97 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.19
description:
[2025-01-28 18:40:53 +0100] info [whostmgrd] 156.228.118.19 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.104
description:
[2025-01-28 18:40:46 +0100] info [cpaneld] 156.228.87.104 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.24
description:
[2025-01-28 18:40:49 +0100] info [cpaneld] 156.228.114.24 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 28 18:41:40 ait sshd[3829427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.81
description:
[2025-01-28 18:40:50 +0100] info [cpaneld] 104.207.39.81 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.171.34
description:
[2025-01-28 18:41:33 +0100] info [webmaild] 37.239.171.34 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.30
description:
[2025-01-28 18:40:48 +0100] info [cpaneld] 156.228.124.30 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.51.226.207
description:
Jan 28 18:41:43 ait sshd[3829427]: Failed password for invalid user elmahk from 20.51.226.207 port 54040 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.164.140.121
description:
[2025-01-28 18:41:49 +0100] info [webmaild] 160.164.140.121 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.219.209.93
description:
[2025-01-28 18:42:19 +0100] info [webmaild] 189.219.209.93 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.177.65
description:
[2025-01-28 18:42:36 +0100] info [webmaild] 177.223.177.65 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.181.142
description:
[2025-01-28 18:43:21 +0100] info [webmaild] 45.180.181.142 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.143.246.196
description:
[2025-01-28 18:42:43 +0100] info [webmaild] 190.143.246.196 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 18:43:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-45.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 28 18:46:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-28 18:46:23 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:41163: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-01-28 18:46:05 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:36366: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
description:
2025-01-28 18:46:13 dovecot_plain authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:44802: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.110.145.241
description:
[2025-01-28 18:45:49 +0100] info [webmaild] 187.110.145.241 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Jan 28 18:46:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-01-28 18:46:04 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:49255: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Jan 28 18:46:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 28 18:46:01 ait sshd[3831682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 28 18:46:01 ait sshd[3831682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Jan 28 18:46:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 18:48:21 ait sshd[3833039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 18:48:21 ait sshd[3833039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
description:
2025-01-28 18:47:45 dovecot_plain authenticator failed for ([182.176.150.182]) [182.176.150.182]:58735: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Jan 28 18:47:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-01-28 18:47:55 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:60582: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.254.62
description:
[2025-01-28 18:48:16 +0100] info [webmaild] 45.231.254.62 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
description:
2025-01-28 18:49:38 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:55587: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
description:
Jan 28 18:49:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
description:
2025-01-28 18:49:07 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:53996: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-01-28 18:49:26 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:54944: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 18:49:30 ait sshd[3833598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.146.48
description:
[2025-01-28 18:49:43 +0100] info [webmaild] 170.231.146.48 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Jan 28 18:49:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 18:49:30 ait sshd[3833598]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 47166


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 18:49:30 ait sshd[3833598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
description:
Jan 28 18:49:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.231
description:
Jan 28 18:49:00 ait sshd[3833290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.231
description:
Jan 28 18:49:00 ait sshd[3833290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 18:49:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 28 18:49:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-28 18:50:01 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:41206: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.226.154.186
description:
[2025-01-28 18:50:20 +0100] info [webmaild] 91.226.154.186 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:51:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 18:51:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.214.125
description:
[2025-01-28 18:51:25 +0100] info [webmaild] 177.137.214.125 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 18:51:25 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:42042: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 18:50:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.242.204.22
description:
Jan 28 18:51:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.242.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.242.204.22
description:
2025-01-28 18:51:50 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:3574: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-28 18:51:52 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:54953: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.158.187.151
description:
[2025-01-28 18:51:58 +0100] info [webmaild] 178.158.187.151 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Jan 28 18:52:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-01-28 18:52:09 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:47644: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 28 18:51:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:51:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.169.248.82
description:
Jan 28 18:52:02 ait sshd[3835012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.169.248.82


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.194.235.201
description:
Jan 28 18:52:17 ait sshd[3835124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.194.235.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.194.235.201
description:
Jan 28 18:52:17 ait sshd[3835124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.194.235.201


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.9.110
description:
Jan 28 18:52:45 ait sshd[3835276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.9.110


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.42.138
description:
[2025-01-28 18:53:03 +0100] info [webmaild] 157.100.42.138 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.9.110
description:
Jan 28 18:52:45 ait sshd[3835276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.9.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:53:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.252.167.86
description:
[2025-01-28 18:53:59 +0100] info [webmaild] 212.252.167.86 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.127.151
description:
[2025-01-28 18:54:42 +0100] info [webmaild] 170.0.127.151 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.194.235.201
description:
Jan 28 18:54:50 ait sshd[3836418]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.194.235.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.58.213.65
description:
[2025-01-28 18:54:59 +0100] info [webmaild] 179.58.213.65 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.55.183
description:
47.128.55.183 - - [28/Jan/2025:18:55:25 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17193891 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C183%2C79%2C198" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.55.183


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.123.3.116
description:
[2025-01-28 18:55:43 +0100] info [webmaild] 187.123.3.116 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 18:55:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 28 18:55:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.194.235.201
description:
Jan 28 18:54:50 ait sshd[3836418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.194.235.201


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 28 18:55:03 ait sshd[3836707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 28 18:55:03 ait sshd[3836707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.15.214.58
description:
[2025-01-28 18:55:05 +0100] info [webmaild] 176.15.214.58 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
description:
2025-01-28 18:56:13 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:41943: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.235.201
description:
Jan 28 18:56:17 ait sshd[3837228]: Failed password for invalid user orati from 118.194.235.201 port 59090 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.169.248.82
description:
Jan 28 18:55:45 ait sshd[3837012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.169.248.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
description:
Jan 28 18:56:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.194.235.201
description:
Jan 28 18:56:15 ait sshd[3837228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.194.235.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.194.235.201
description:
Jan 28 18:56:15 ait sshd[3837228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.194.235.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-01-28 18:55:45 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:50732: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 28 18:56:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-01-28 18:57:07 dovecot_login authenticator failed for ([111.48.214.96]) [111.48.214.96]:34308: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.9.110
description:
Jan 28 18:57:11 ait sshd[3837750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.9.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 28 18:57:17 ait sshd[3837785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Jan 28 18:56:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.169.248.82
description:
Jan 28 18:57:03 ait sshd[3837675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.169.248.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Jan 28 18:57:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.9.110
description:
Jan 28 18:57:11 ait sshd[3837750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.9.110


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 221.156.137.103
description:
Jan 28 18:57:17 ait sshd[3837785]: Invalid user universitypublishing from 221.156.137.103 port 55118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-28 18:56:58 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:50222: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 18:56:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
description:
Jan 28 18:57:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-01-28 18:56:50 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:39020: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 28 18:57:17 ait sshd[3837785]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
description:
2025-01-28 18:57:21 dovecot_login authenticator failed for ([39.155.191.166]) [39.155.191.166]:39526: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-28 18:58:06 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:53939: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.79.138.248
description:
[2025-01-28 18:58:06 +0100] info [webmaild] 201.79.138.248 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 28 18:58:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Jan 28 18:58:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 28 18:58:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-01-28 18:58:40 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:54486: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Jan 28 18:57:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-28 18:57:58 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:43468: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-28 18:58:28 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:32929: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 18:58:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Jan 28 18:58:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.203.182.247
description:
[2025-01-28 18:59:00 +0100] info [webmaild] 189.203.182.247 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-01-28 18:58:45 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:38202: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 28 18:58:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-28 18:58:56 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:51684: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 19:00:36 ait sshd[3839853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 67.209.135.146
description:
[2025-01-28 19:00:36 +0100] info [webmaild] 67.209.135.146 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 19:00:35 ait sshd[3839853]: Invalid user h1-lubricants.net 2a00 from 122.51.104.242 port 55886


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 19:00:36 ait sshd[3839853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.81.212.144
description:
[2025-01-28 18:59:51 +0100] info [webmaild] 41.81.212.144 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.201.51
description:
[2025-01-28 18:59:55 +0100] info [webmaild] 45.5.201.51 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-01-28 19:01:40 dovecot_plain authenticator failed for (brians) [62.182.116.64]:52807: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.173.131
description:
Jan 28 19:00:56 ait sshd[3839967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.173.131


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 19:00:48 ait sshd[3839926]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.173.131
description:
Jan 28 19:00:56 ait sshd[3839967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.173.131 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 19:00:48 ait sshd[3839926]: Invalid user h1-lubricants.net 2a00 from 122.51.104.242 port 60530


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 19:00:48 ait sshd[3839926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Jan 28 19:01:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.41.48
description:
[2025-01-28 19:02:07 +0100] info [webmaild] 158.181.41.48 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 19:03:30 ait sshd[3841513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 28 19:02:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 28 19:03:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-28 19:03:23 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:52555: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.136.158
description:
[2025-01-28 19:02:43 +0100] info [webmaild] 45.191.136.158 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-28 19:02:56 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:58082: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.9.110
description:
Jan 28 19:03:44 ait sshd[3841564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.9.110  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:04:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.9.110
description:
Jan 28 19:03:44 ait sshd[3841564]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.9.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-28 19:03:47 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:50920: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 19:04:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.241.255
description:
[2025-01-28 19:04:01 +0100] info [webmaild] 45.236.241.255 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.248.46
description:
[2025-01-28 19:04:31 +0100] info [webmaild] 186.68.248.46 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
description:
Jan 28 19:05:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-28 19:04:56 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:56080: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.38.162.158
description:
[2025-01-28 19:04:53 +0100] info [webmaild] 179.38.162.158 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.115.104.38
description:
Jan 28 19:05:16 ait sshd[3842699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.115.104.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.104.38
description:
Jan 28 19:05:16 ait sshd[3842699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.115.104.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-01-28 19:05:22 dovecot_plain authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:48878: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Jan 28 19:04:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.108
description:
Jan 28 19:06:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.108
description:
2025-01-28 19:06:08 dovecot_plain authenticator failed for 111-70-3-108.emome-ip.hinet.net [111.70.3.108]:49521: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 19:05:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.204.22
description:
Jan 28 19:06:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.245
description:
Jan 28 19:06:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Jan 28 19:05:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.245
description:
2025-01-28 19:06:18 dovecot_plain authenticator failed for 111-70-23-245.emome-ip.hinet.net [111.70.23.245]:47779: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.204.22
description:
2025-01-28 19:06:28 dovecot_plain authenticator failed for ([196.46.204.22]) [196.46.204.22]:38701: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.120.166.51
description:
[2025-01-28 19:06:32 +0100] info [webmaild] 103.120.166.51 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
description:
Jan 28 19:06:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
description:
2025-01-28 19:06:03 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:45856: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Jan 28 19:06:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-01-28 19:05:53 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:53740: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-01-28 19:06:21 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:35539: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-01-28 19:07:03 dovecot_plain authenticator failed for ([175.156.80.166]) [175.156.80.166]:35841: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
description:
Jan 28 19:07:39 ait sshd[3843916]: Invalid user universitypublishing from 211.108.234.111 port 43880


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.191.170.208
description:
Jan 28 19:06:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.191.170.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.191.170.208
description:
2025-01-28 19:06:58 dovecot_login authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:38462: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
description:
Jan 28 19:07:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Jan 28 19:07:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 28 19:07:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 28 19:07:39 ait sshd[3843916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
description:
Jan 28 19:06:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Jan 28 19:07:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-01-28 19:07:08 dovecot_login authenticator failed for ([47.149.190.181]) [47.149.190.181]:49188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.133.170
description:
[2025-01-28 19:07:24 +0100] info [webmaild] 37.239.133.170 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.75.226.140
description:
[2025-01-28 19:07:33 +0100] info [webmaild] 177.75.226.140 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 28 19:07:39 ait sshd[3843916]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 19:07:42 +0100] info [webmaild] 217.160.25.51 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-01-28 19:06:47 dovecot_plain authenticator failed for ([187.161.226.88]) [187.161.226.88]:51759: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-28 19:07:30 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:19632: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:07:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-01-28 19:07:43 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:61680: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.18.96.126
description:
[2025-01-28 19:07:54 +0100] info [webmaild] 37.18.96.126 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.227.64.254
description:
[2025-01-28 19:08:15 +0100] info [webmaild] 41.227.64.254 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Jan 28 19:07:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 19:08:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.134.146
description:
Jan 28 19:08:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.134.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.162
description:
[2025-01-28 19:09:30 +0100] info [cpaneld] 104.207.59.162 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.156
description:
[2025-01-28 19:09:33 +0100] info [whostmgrd] 156.228.83.156 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.89
description:
[2025-01-28 19:09:29 +0100] info [cpaneld] 104.207.49.89 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng20b00215y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.208
description:
[2025-01-28 19:09:31 +0100] info [cpaneld] 156.228.91.208 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.62.232
description:
[2025-01-28 19:09:33 +0100] info [whostmgrd] 104.207.62.232 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.235
description:
[2025-01-28 19:09:34 +0100] info [whostmgrd] 156.228.98.235 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 19:09:42 ait sshd[3845142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 19:09:42 ait sshd[3845142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:08:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Jan 28 19:09:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-28 19:08:57 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:55971: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.113
description:
[2025-01-28 19:09:35 +0100] info [whostmgrd] 156.228.85.113 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-28 19:09:42 dovecot_login authenticator failed for ([180.69.30.93]) [180.69.30.93]:51650: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 28 19:08:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.95
description:
[2025-01-28 19:09:31 +0100] info [cpaneld] 104.207.52.95 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng20b00215y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.31
description:
[2025-01-28 19:09:32 +0100] info [whostmgrd] 104.207.36.31 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.22
description:
[2025-01-28 19:09:32 +0100] info [cpaneld] 104.207.57.22 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng20b00215y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-28 19:09:34 dovecot_login authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:36837: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
description:
2025-01-28 19:08:47 dovecot_login authenticator failed for ([36.154.134.146]) [36.154.134.146]:34332: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 28 19:09:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.182
description:
[2025-01-28 19:09:34 +0100] info [whostmgrd] 156.228.90.182 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
description:
2025-01-28 19:10:33 dovecot_login authenticator failed for ([124.112.45.222]) [124.112.45.222]:38329: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-28 19:10:35 dovecot_login authenticator failed for ([1.245.207.104]) [1.245.207.104]:38869: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.160
description:
Jan 28 19:10:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.211.41
description:
[2025-01-28 19:10:26 +0100] info [webmaild] 45.175.211.41 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
description:
Jan 28 19:09:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Jan 28 19:10:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
description:
2025-01-28 19:10:42 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:43932: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Jan 28 19:10:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 19:09:47 ait sshd[3845187]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 57736


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
description:
2025-01-28 19:10:06 dovecot_login authenticator failed for ([121.167.217.147]) [121.167.217.147]:56304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
description:
Jan 28 19:10:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-28 19:09:52 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:53265: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.114.191.28
description:
[2025-01-28 19:10:11 +0100] info [webmaild] 181.114.191.28 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 19:10:16 ait sshd[3845668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Jan 28 19:10:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.147.125.200
description:
Jan 28 19:09:44 ait sshd[3845142]: Failed password for invalid user michael from 185.147.125.200 port 28623 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 19:09:47 ait sshd[3845187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-01-28 19:10:00 dovecot_login authenticator failed for ([110.35.63.30]) [110.35.63.30]:56790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-01-28 19:10:22 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:35542: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-01-28 19:10:41 dovecot_login authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:55362: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 19:09:47 ait sshd[3845187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 19:10:16 ait sshd[3845668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-01-28 19:10:21 dovecot_login authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:63112: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 28 19:10:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
description:
Jan 28 19:10:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Jan 28 19:09:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-01-28 19:09:45 dovecot_login authenticator failed for ([1.183.1.82]) [1.183.1.82]:39965: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Jan 28 19:09:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Jan 28 19:11:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-01-28 19:11:03 dovecot_login authenticator failed for ([114.221.2.199]) [114.221.2.199]:54316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Jan 28 19:11:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-01-28 19:11:09 dovecot_login authenticator failed for ([121.202.152.120]) [121.202.152.120]:50205: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 28 19:12:03 ait sshd[3846663]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.194.191
description:
Jan 28 19:12:11 ait sshd[3846781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.30.194.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.58
description:
[2025-01-28 19:12:27 +0100] info [webmaild] 84.54.72.58 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 19:11:50 ait sshd[3846576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 19:11:50 ait sshd[3846576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 28 19:12:03 ait sshd[3846663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.30.194.191
description:
Jan 28 19:12:11 ait sshd[3846781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.30.194.191


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.220.39.38
description:
[2025-01-28 19:12:14 +0100] info [webmaild] 186.220.39.38 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
description:
2025-01-28 19:12:38 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:63391: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
description:
Jan 28 19:12:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 19:12:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 19:12:43 ait sshd[3847048]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.3.79
description:
Jan 28 19:12:54 ait sshd[3847131]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.3.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:13:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.3.79
description:
Jan 28 19:12:54 ait sshd[3847131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.3.79


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 19:12:43 ait sshd[3847048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Jan 28 19:12:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-01-28 19:12:50 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:36732: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.143.23
description:
[2025-01-28 19:13:10 +0100] info [webmaild] 45.184.143.23 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.49.64
description:
47.128.49.64 - - [28/Jan/2025:19:13:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23191336 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?filter_course-language=95%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.49.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 28 19:14:24 ait sshd[3847922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.235.68.52
description:
Jan 28 19:14:09 ait sshd[3847700]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.235.68.52 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.235.68.52
description:
Jan 28 19:14:09 ait sshd[3847700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.235.68.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.115.161.177
description:
[2025-01-28 19:14:21 +0100] info [webmaild] 196.115.161.177 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Jan 28 19:14:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-01-28 19:14:17 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:46148: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.142
description:
Jan 28 19:14:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 28 19:14:24 ait sshd[3847922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
description:
2025-01-28 19:14:27 dovecot_plain authenticator failed for ([116.113.253.142]) [116.113.253.142]:44611: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
description:
Jan 28 19:15:09 ait sshd[3848523]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.203
description:
Jan 28 19:15:27 ait sshd[3848523]: error: maximum authentication attempts exceeded for root from 218.92.0.203 port 31058 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 28 19:15:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
description:
Jan 28 19:15:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 28 19:14:49 ait sshd[3848278]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.61.58
description:
47.128.61.58 - - [28/Jan/2025:19:15:40 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16505679 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?filter_course-language=120%2C198&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.61.58


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-28 19:15:32 dovecot_plain authenticator failed for ([82.193.122.91]) [82.193.122.91]:40693: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.25.209
description:
Jan 28 19:15:13 ait sshd[3848534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.163.25.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 28 19:14:49 ait sshd[3848278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.203
description:
Jan 28 19:15:09 ait sshd[3848523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Jan 28 19:15:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-01-28 19:15:37 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:45570: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-01-28 19:15:26 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:51588: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.163.25.209
description:
Jan 28 19:15:13 ait sshd[3848534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.25.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.245.199
description:
[2025-01-28 19:15:15 +0100] info [webmaild] 201.49.245.199 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-28 19:15:55 dovecot_plain authenticator failed for (duawenes) [178.250.191.189]:53428: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.170.94
description:
Jan 28 19:16:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.170.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 28 19:16:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.224.106.47
description:
Jan 28 19:15:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.224.106.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 28 19:15:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-28 19:16:41 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:52310: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.3.79
description:
Jan 28 19:16:40 ait sshd[3849347]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.3.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.51.158
description:
2025-01-28 19:16:21 dovecot_login authenticator failed for ([189.31.51.158]) [189.31.51.158]:42225: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.143.234.101
description:
[2025-01-28 19:16:35 +0100] info [webmaild] 103.143.234.101 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.224.106.47
description:
2025-01-28 19:15:45 dovecot_plain authenticator failed for ([117.72.66.209]) [27.224.106.47]:15981: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.3.79
description:
Jan 28 19:16:40 ait sshd[3849347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.3.79


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Jan 28 19:16:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.31.51.158
description:
Jan 28 19:16:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.31.51.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.170.94
description:
2025-01-28 19:16:32 dovecot_login authenticator failed for (94.170.89.103.dynamic.dreamlink.in) [103.89.170.94]:58704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.159.8
description:
[2025-01-28 19:15:51 +0100] info [webmaild] 177.39.159.8 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.34.130
description:
47.128.34.130 - - [28/Jan/2025:19:15:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21827353 HTTP/2.0" 302 0 ait-open.net "https://ait-open.net/elearning/course/info.php?id=860" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.34.130


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.225.3.79
description:
Jan 28 19:16:44 ait sshd[3849347]: Disconnected from invalid user ubuntu 14.225.3.79 port 47980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.39.166
description:
2025-01-28 19:17:33 dovecot_login authenticator failed for ([60.28.39.166]) [60.28.39.166]:34494: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.194.191
description:
Jan 28 19:17:13 ait sshd[3849567]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.30.194.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
description:
2025-01-28 19:16:50 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:48135: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
description:
2025-01-28 19:16:59 dovecot_login authenticator failed for ([46.29.121.110]) [46.29.121.110]:38736: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Jan 28 19:16:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-01-28 19:16:48 dovecot_plain authenticator failed for (redimencor) [65.20.128.78]:49470: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
description:
Jan 28 19:16:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.39.166
description:
Jan 28 19:17:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.39.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
description:
Jan 28 19:16:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
description:
Jan 28 19:16:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
description:
2025-01-28 19:16:55 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:58062: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.30.194.191
description:
Jan 28 19:17:13 ait sshd[3849567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.30.194.191


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.114.199.23
description:
[2025-01-28 19:17:01 +0100] info [webmaild] 41.114.199.23 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.223
description:
Jan 28 19:18:22 ait sshd[3850321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.223  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.225.3.79
description:
Jan 28 19:18:25 ait sshd[3850330]: Failed password for invalid user test from 14.225.3.79 port 46656 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.223
description:
Jan 28 19:18:22 ait sshd[3850321]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-28 19:17:46 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:60022: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-18.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.3.79
description:
Jan 28 19:18:22 ait sshd[3850330]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.3.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 28 19:17:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.3.79
description:
Jan 28 19:18:22 ait sshd[3850330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.3.79


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 19:18:56 ait sshd[3850493]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 43296


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.128.137.31
description:
[2025-01-28 19:18:55 +0100] info [webmaild] 186.128.137.31 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:19:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.223
description:
Jan 28 19:19:07 ait sshd[3850528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.235.68.52
description:
Jan 28 19:19:12 ait sshd[3850616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.235.68.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.194.191
description:
Jan 28 19:19:13 ait sshd[3850620]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.30.194.191 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.30.194.191
description:
Jan 28 19:19:13 ait sshd[3850620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.30.194.191


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.235.68.52
description:
Jan 28 19:19:12 ait sshd[3850616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.235.68.52


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 19:18:56 ait sshd[3850493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 19:18:56 ait sshd[3850493]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.223
description:
Jan 28 19:19:07 ait sshd[3850528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.223  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.136.194.13
description:
[2025-01-28 19:19:40 +0100] info [webmaild] 177.136.194.13 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 19:20:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (eproly) [87.103.126.54]:51641: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-28 19:20:26 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (pring) [91.56.31.167]:62568: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.104.178
description:
[2025-01-28 19:19:50 +0100] info [webmaild] 170.82.104.178 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 19:20:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.34.84
description:
Jan 28 19:20:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.25.209
description:
Jan 28 19:20:05 ait sshd[3851259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.163.25.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 19:19:46 dovecot_plain authenticator failed for (clatelato) [81.211.77.58]:39087: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.43.249
description:
[2025-01-28 19:20:36 +0100] info [webmaild] 177.73.43.249 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.235.68.52
description:
Jan 28 19:20:33 ait sshd[3851605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.235.68.52


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 28 19:20:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 19:19:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.4.144.86
description:
2025-01-28 19:20:33 dovecot_plain authenticator failed for ([103.4.144.86]) [103.4.144.86]:52741: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.4.144.86
description:
Jan 28 19:20:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.4.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.54.69
description:
[2025-01-28 19:20:29 +0100] info [webmaild] 181.199.54.69 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.235.68.52
description:
Jan 28 19:20:33 ait sshd[3851605]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.235.68.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
description:
2025-01-28 19:20:42 dovecot_plain authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:54438: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.163.25.209
description:
Jan 28 19:20:05 ait sshd[3851259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.25.209


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.25.209
description:
Jan 28 19:21:40 ait sshd[3851997]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.163.25.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.139.226.70
description:
[2025-01-28 19:21:34 +0100] info [webmaild] 5.139.226.70 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.163.25.209
description:
Jan 28 19:21:40 ait sshd[3851997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.25.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-28 19:22:26 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:53615: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.54.82
description:
[2025-01-28 19:22:35 +0100] info [webmaild] 138.0.54.82 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 19:22:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.146.4
description:
2025-01-28 19:22:09 dovecot_plain authenticator failed for (cenostle) [37.99.146.4]:53035: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
description:
2025-01-28 19:22:02 dovecot_plain authenticator failed for (ovendal) [65.20.204.164]:57627: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Jan 28 19:22:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 28 19:22:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.164
description:
Jan 28 19:22:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 19:22:06 dovecot_plain authenticator failed for (bionmook) [81.211.77.58]:53356: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.99.146.4
description:
Jan 28 19:22:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.99.146.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-28 19:22:16 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:49366: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-28 19:23:03 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:51840: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 28 19:23:40 ait sshd[3852895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-01-28 19:22:49 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:48333: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 28 19:23:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 28 19:23:40 ait sshd[3852895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Jan 28 19:22:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.6.55.57
description:
Jan 28 19:24:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.6.55.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.235.182.148
description:
[2025-01-28 19:24:25 +0100] info [webmaild] 176.235.182.148 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
description:
2025-01-28 19:24:35 dovecot_plain authenticator failed for ([119.6.55.57]) [119.6.55.57]:40530: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-28 19:24:49 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:46088: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.178.55.68
description:
[2025-01-28 19:25:02 +0100] info [webmaild] 160.178.55.68 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.120.4.117
description:
[2025-01-28 19:25:20 +0100] info [webmaild] 178.120.4.117 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 28 19:24:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 28 19:24:57 ait sshd[3853781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 28 19:24:57 ait sshd[3853781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 28 19:26:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-01-28 19:26:14 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:47365: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 19:25:53 ait sshd[3854476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Jan 28 19:26:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
description:
Jan 28 19:26:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.205.17.22
description:
[2025-01-28 19:26:40 +0100] info [webmaild] 186.205.17.22 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 19:25:53 ait sshd[3854476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.17.16
description:
Jan 28 19:26:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.17.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
description:
Jan 28 19:26:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-01-28 19:26:42 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:51576: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.17.16
description:
2025-01-28 19:26:05 dovecot_plain authenticator failed for ([223.84.17.16]) [223.84.17.16]:1035: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 28 19:26:41 ait sshd[3854007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-28 19:26:03 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:45221: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-01-28 19:26:17 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:40286: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 28 19:26:41 ait sshd[3854007]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
description:
Jan 28 19:26:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
description:
2025-01-28 19:27:34 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:53281: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-01-28 19:27:29 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:47080: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
description:
Jan 28 19:27:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Jan 28 19:27:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.101.164
description:
[2025-01-28 19:27:28 +0100] info [webmaild] 138.219.101.164 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
description:
2025-01-28 19:26:57 dovecot_plain authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:54068: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.78
description:
Jan 28 19:27:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.78
description:
2025-01-28 19:27:31 dovecot_login authenticator failed for ([122.187.246.78]) [122.187.246.78]:42918: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
description:
Jan 28 19:27:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.111.23.53
description:
[2025-01-28 19:27:07 +0100] info [webmaild] 179.111.23.53 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 28 19:27:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-28 19:27:49 dovecot_login authenticator failed for ([120.71.199.46]) [120.71.199.46]:35938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-01-28 19:27:49 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:36800: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:28:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Jan 28 19:27:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-28 19:27:57 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:38872: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.154.199.12
description:
Jan 28 19:27:59 ait sshd[3855524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.199.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
description:
2025-01-28 19:28:19 dovecot_login authenticator failed for ([195.158.19.6]) [195.158.19.6]:52772: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.204.106
description:
Jan 28 19:28:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.204.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 28 19:28:42 ait sshd[3855806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
description:
2025-01-28 19:27:45 dovecot_login authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:44450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.154.199.12
description:
Jan 28 19:27:59 ait sshd[3855524]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.154.199.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
description:
Jan 28 19:28:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
description:
Jan 28 19:28:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
description:
2025-01-28 19:28:17 dovecot_plain authenticator failed for ([219.144.16.16]) [219.144.16.16]:59447: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Jan 28 19:28:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 28 19:28:42 ait sshd[3855806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 28 19:27:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-01-28 19:28:01 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:35576: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.235
description:
Jan 28 19:28:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.235
description:
2025-01-28 19:28:09 dovecot_plain authenticator failed for 110-25-105-235.adsl.fetnet.net [110.25.105.235]:40868: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.106
description:
2025-01-28 19:28:30 dovecot_login authenticator failed for ([125.23.204.106]) [125.23.204.106]:42332: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Jan 28 19:27:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-01-28 19:28:45 dovecot_login authenticator failed for ([183.230.252.103]) [183.230.252.103]:58058: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.18.221.64
description:
[2025-01-28 19:29:13 +0100] info [webmaild] 189.18.221.64 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 28 19:28:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-28 19:28:55 dovecot_login authenticator failed for ([188.226.47.211]) [188.226.47.211]:53764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.171.124
description:
[2025-01-28 19:29:27 +0100] info [webmaild] 45.236.171.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.68
description:
[2025-01-28 19:30:27 +0100] info [whostmgrd] 154.214.1.68 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 28 19:30:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.150
description:
[2025-01-28 19:30:21 +0100] info [cpaneld] 104.207.41.150 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.115
description:
[2025-01-28 19:30:22 +0100] info [cpaneld] 156.228.109.115 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.62
description:
[2025-01-28 19:30:22 +0100] info [cpaneld] 104.207.52.62 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.14
description:
[2025-01-28 19:30:25 +0100] info [whostmgrd] 104.207.61.14 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.137
description:
[2025-01-28 19:30:28 +0100] info [whostmgrd] 104.207.57.137 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.37.68
description:
[2025-01-28 19:30:29 +0100] info [whostmgrd] 104.207.37.68 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-28 19:30:37 dovecot_plain authenticator failed for (inearrock) [94.140.210.134]:42841: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.38
description:
[2025-01-28 19:30:21 +0100] info [cpaneld] 156.228.93.38 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.207
description:
[2025-01-28 19:30:23 +0100] info [cpaneld] 104.207.40.207 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.83
description:
[2025-01-28 19:30:23 +0100] info [whostmgrd] 104.207.45.83 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.66
description:
[2025-01-28 19:30:29 +0100] info [whostmgrd] 104.207.42.66 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
description:
2025-01-28 19:31:10 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:60046: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-28 19:30:53 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:47993: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.175.181.227
description:
[2025-01-28 19:31:12 +0100] info [webmaild] 212.175.181.227 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.173.173.60
description:
Jan 28 19:30:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.173.173.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.173.173.60
description:
2025-01-28 19:30:47 dovecot_plain authenticator failed for (fratochoid) [178.173.173.60]:51551: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 28 19:30:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
description:
Jan 28 19:31:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.48.182
description:
47.128.48.182 - - [28/Jan/2025:19:32:07 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16579397" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.48.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.137.249
description:
[2025-01-28 19:32:18 +0100] info [webmaild] 177.91.137.249 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 19:32:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 28 19:32:17 ait sshd[3858290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 19:32:27 dovecot_plain authenticator failed for (exprocily) [81.211.77.58]:11688: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.88
description:
47.128.96.88 - - [28/Jan/2025:19:31:52 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4723733 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/mod/forum/discuss.php?d=8317" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.161.105
description:
[2025-01-28 19:31:55 +0100] info [webmaild] 45.226.161.105 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 28 19:32:17 ait sshd[3858290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.178.212
description:
[2025-01-28 19:32:48 +0100] info [webmaild] 45.165.178.212 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 28 19:33:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-28 19:33:10 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (micannut) [109.164.246.53]:39138: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.126.65.135
description:
Jan 28 19:33:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.126.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.135
description:
2025-01-28 19:33:28 dovecot_plain authenticator failed for ([216.126.65.135]) [216.126.65.135]:59967: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.111.148.191
description:
[2025-01-28 19:32:49 +0100] info [webmaild] 105.111.148.191 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 36.37.169.234
description:
[2025-01-28 19:33:05 +0100] info [webmaild] 36.37.169.234 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 28 19:33:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 28 19:34:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-28 19:33:59 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:3717: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-01-28 19:34:07 dovecot_plain authenticator failed for ([112.194.143.206]) [112.194.143.206]:51244: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 28 19:34:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-28 19:34:17 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:45448: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:34:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-28 19:34:51 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:61263: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
description:
Jan 28 19:34:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
description:
2025-01-28 19:35:00 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:36596: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 28 19:34:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 19:35:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 19:35:11 +0100] info [cpaneld] 217.160.25.51 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.215.190
description:
[2025-01-28 19:34:44 +0100] info [webmaild] 45.234.215.190 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
description:
2025-01-28 19:36:06 dovecot_plain authenticator failed for ([191.36.156.14]) [191.36.156.14]:33415: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 28 19:36:23 ait sshd[3861071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 28 19:36:11 ait sshd[3860964]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.173.41.125
description:
[2025-01-28 19:36:33 +0100] info [webmaild] 78.173.41.125 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.129
description:
2025-01-28 19:36:19 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.129]:3293: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 28 19:36:11 ait sshd[3860964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.129
description:
Jan 28 19:36:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 28 19:36:23 ait sshd[3861071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
description:
Jan 28 19:36:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.242.69.155
description:
[2025-01-28 19:38:39 +0100] info [webmaild] 88.242.69.155 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.170.33.85
description:
[2025-01-28 19:37:52 +0100] info [webmaild] 41.170.33.85 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.98.42.218
description:
[2025-01-28 19:37:58 +0100] info [webmaild] 177.98.42.218 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:38:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-01-28 19:39:14 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:39940: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
description:
Jan 28 19:39:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-01-28 19:39:19 dovecot_login authenticator failed for ([104.236.145.128]) [104.236.145.128]:47220: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
description:
Jan 28 19:39:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
description:
2025-01-28 19:39:35 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:63709: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.251.108.124
description:
Jan 28 19:39:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.251.108.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
description:
Jan 28 19:39:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.155.16.231
description:
2025-01-28 19:39:33 dovecot_login authenticator failed for ([121.155.16.231]) [121.155.16.231]:45980: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Jan 28 19:39:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
description:
2025-01-28 19:39:38 dovecot_login authenticator failed for ([31.220.168.116]) [31.220.168.116]:41584: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.246.139
description:
[2025-01-28 19:39:05 +0100] info [webmaild] 201.49.246.139 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-28 19:39:07 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:43474: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-01-28 19:39:16 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:58431: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 28 19:39:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-28 19:39:28 dovecot_login authenticator failed for ([159.89.232.138]) [159.89.232.138]:31546: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
description:
2025-01-28 19:39:31 dovecot_login authenticator failed for ([111.48.214.102]) [111.48.214.102]:45002: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Jan 28 19:39:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.21
description:
2025-01-28 19:39:17 dovecot_login authenticator failed for s142-59-214-21.ab.hsia.telus.net [142.59.214.21]:51766: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.155.16.231
description:
Jan 28 19:39:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.155.16.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 28 19:39:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.252.18.246
description:
2025-01-28 19:39:08 dovecot_login authenticator failed for ([162.252.18.246]) [162.252.18.246]:60836: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.252.18.246
description:
Jan 28 19:39:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.252.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.21
description:
Jan 28 19:39:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.239.191.211
description:
Jan 28 19:39:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.239.191.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
description:
Jan 28 19:39:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.158.138.179
description:
Jan 28 19:40:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.158.138.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
description:
2025-01-28 19:40:02 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:37724: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.239.191.211
description:
2025-01-28 19:39:46 dovecot_login authenticator failed for 211.sub-166-239-191.myvzw.com [166.239.191.211]:53851: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
description:
2025-01-28 19:39:50 dovecot_login authenticator failed for ([120.194.50.39]) [120.194.50.39]:33100: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.20.14
description:
[2025-01-28 19:39:57 +0100] info [webmaild] 37.238.20.14 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 19:41:28 ait sshd[3864186]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 28 19:40:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Jan 28 19:40:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.166
description:
Jan 28 19:41:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
description:
2025-01-28 19:41:06 dovecot_plain authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:45213: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-28 19:40:52 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:48218: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-01-28 19:40:55 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:60613: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.196.38.132
description:
[2025-01-28 19:41:39 +0100] info [webmaild] 200.196.38.132 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 19:41:12 ait sshd[3864046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 19:41:28 ait sshd[3864186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
description:
Jan 28 19:41:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
description:
2025-01-28 19:41:09 dovecot_plain authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:43408: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 19:41:12 ait sshd[3864046]: Invalid user accessrentacar.com.au 2404 from 111.231.56.128 port 50678


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 19:41:12 ait sshd[3864046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
description:
Jan 28 19:42:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
description:
2025-01-28 19:42:07 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:54002: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 28 19:42:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.152.220
description:
Jan 28 19:42:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.152.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-28 19:42:26 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:36644: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.177.41.155
description:
[2025-01-28 19:41:54 +0100] info [webmaild] 177.177.41.155 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 19:43:08 ait sshd[3865085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 19:43:08 ait sshd[3865085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.177.172
description:
[2025-01-28 19:44:24 +0100] info [webmaild] 177.86.177.172 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.249.223
description:
[2025-01-28 19:43:50 +0100] info [webmaild] 45.161.249.223 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 19:44:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.205
description:
Jan 28 19:44:51 ait sshd[3866062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.205  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.205
description:
Jan 28 19:44:51 ait sshd[3866062]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.226.180
description:
[2025-01-28 19:44:53 +0100] info [webmaild] 138.59.226.180 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.183.147.70
description:
[2025-01-28 19:45:22 +0100] info [webmaild] 177.183.147.70 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.223
description:
47.128.112.223 - - [28/Jan/2025:19:45:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15891670 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C125%2C61&filter_course-language=120%2C183%2C99%2C198%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 19:46:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 19:46:36 dovecot_plain authenticator failed for (poide) [81.211.77.58]:34380: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.160.16.33
description:
[2025-01-28 19:45:43 +0100] info [webmaild] 181.160.16.33 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 28 19:46:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 28 19:46:31 ait sshd[3867000]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 28 19:46:31 ait sshd[3867000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 28 19:46:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.111
description:
[2025-01-28 19:48:31 +0100] info [cpaneld] 156.228.116.111 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.83
description:
[2025-01-28 19:48:32 +0100] info [cpaneld] 104.207.52.83 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.46.38
description:
[2025-01-28 19:48:32 +0100] info [cpaneld] 104.207.46.38 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.81
description:
[2025-01-28 19:48:33 +0100] info [cpaneld] 104.207.39.81 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.79
description:
[2025-01-28 19:48:37 +0100] info [whostmgrd] 156.228.124.79 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.41
description:
[2025-01-28 19:48:40 +0100] info [whostmgrd] 156.228.117.41 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.251
description:
[2025-01-28 19:48:41 +0100] info [whostmgrd] 104.207.50.251 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
description:
Jan 28 19:48:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.113.122
description:
[2025-01-28 19:48:33 +0100] info [cpaneld] 156.228.113.122 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.43
description:
[2025-01-28 19:48:39 +0100] info [whostmgrd] 156.228.125.43 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 28 19:48:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-28 19:48:39 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:12860: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.197
description:
[2025-01-28 19:48:41 +0100] info [whostmgrd] 156.228.81.197 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
description:
2025-01-28 19:48:28 dovecot_plain authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:37332: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 19:49:29 ait sshd[3868848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 19:49:29 ait sshd[3868848]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 19:49:29 ait sshd[3868853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 19:48:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 19:49:29 ait sshd[3868853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.129.134.43
description:
[2025-01-28 19:48:52 +0100] info [webmaild] 103.129.134.43 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.76.50.164
description:
[2025-01-28 19:49:54 +0100] info [webmaild] 80.76.50.164 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 28 19:50:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.72.57
description:
[2025-01-28 19:50:39 +0100] info [webmaild] 179.60.72.57 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
description:
Jan 28 19:50:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.52
description:
[2025-01-28 19:50:07 +0100] info [webmaild] 213.230.93.52 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 19:49:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-28 19:50:20 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:32882: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
description:
2025-01-28 19:50:29 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:35166: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.106.36.218
description:
[2025-01-28 19:51:29 +0100] info [webmaild] 79.106.36.218 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:51:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-52.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 19:51:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:52:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 19:52:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.11.8.162
description:
[2025-01-28 19:52:10 +0100] info [webmaild] 186.11.8.162 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.112.190
description:
2025-01-28 19:53:43 dovecot_plain authenticator failed for ([60.219.112.190]) [60.219.112.190]:60385: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.112.190
description:
Jan 28 19:53:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.112.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 19:52:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-01-28 19:54:05 dovecot_login authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:57618: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 19:54:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Jan 28 19:54:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
description:
Jan 28 19:53:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Jan 28 19:54:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
description:
2025-01-28 19:54:17 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:47720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.174.136
description:
Jan 28 19:54:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.174.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 19:54:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-01-28 19:54:03 dovecot_login authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:55240: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.144.200
description:
[2025-01-28 19:53:58 +0100] info [webmaild] 186.225.144.200 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Jan 28 19:54:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Jan 28 19:54:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.171.0
description:
[2025-01-28 19:54:08 +0100] info [webmaild] 177.105.171.0 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
description:
2025-01-28 19:54:25 dovecot_login authenticator failed for ([117.159.174.136]) [117.159.174.136]:37534: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-01-28 19:54:07 dovecot_login authenticator failed for ([58.224.55.22]) [58.224.55.22]:47942: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
description:
2025-01-28 19:53:55 dovecot_plain authenticator failed for ([183.249.1.112]) [183.249.1.112]:32934: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-01-28 19:54:18 dovecot_login authenticator failed for ([218.55.177.39]) [218.55.177.39]:36844: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
description:
Jan 28 19:54:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.162.110.117
description:
[2025-01-28 19:55:24 +0100] info [webmaild] 201.162.110.117 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.25.51
description:
2025-01-28 19:54:57 dovecot_plain authenticator failed for ([217.160.25.51]) [217.160.25.51]:58165: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 19:55:05 ait sshd[3872026]: Invalid user h1-lubricants.net 2a00 from 122.51.104.242 port 37882


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 19:55:06 ait sshd[3872026]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-28 19:54:56 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:21099: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.25.51
description:
Jan 28 19:54:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.160.25.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Jan 28 19:55:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 19:55:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 19:55:06 ait sshd[3872026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 28 19:54:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-01-28 19:55:13 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:49484: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.49.221.43
description:
Jan 28 19:56:41 ait sshd[3872929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.49.221.43  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.135
description:
Jan 28 19:56:02 ait sshd[3872631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.135


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.221.43
description:
Jan 28 19:56:41 ait sshd[3872929]: pam_imunify(sshd:auth): [IM360_RBL] The IP 58.49.221.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.135
description:
Jan 28 19:56:02 ait sshd[3872631]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.87.253.64
description:
[2025-01-28 19:56:12 +0100] info [webmaild] 201.87.253.64 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.221.43
description:
Jan 28 19:56:46 ait sshd[3872979]: pam_imunify(sshd:auth): [IM360_RBL] The IP 58.49.221.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.188.155.73
description:
[2025-01-28 19:57:44 +0100] info [webmaild] 187.188.155.73 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.25.51
description:
2025-01-28 19:57:03 dovecot_plain authenticator failed for ([217.160.25.51]) [217.160.25.51]:58249: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.228.121.220
description:
Jan 28 19:57:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.228.121.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.183.29
description:
[2025-01-28 19:56:54 +0100] info [webmaild] 177.37.183.29 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.25.51
description:
Jan 28 19:57:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.160.25.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.49.221.43
description:
Jan 28 19:56:46 ait sshd[3872979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.49.221.43  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 209.14.149.144
description:
[2025-01-28 19:57:12 +0100] info [webmaild] 209.14.149.144 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS23B00195Y||WPU:ADS23B00195Y||RSV:6.65||T:APACHE||MV:19-57.170.205.31.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.47.136
description:
[2025-01-28 19:57:54 +0100] info [webmaild] 138.219.47.136 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 28 19:57:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.228.121.220
description:
Jan 28 19:57:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.228.121.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.55.146.40
description:
Jan 28 19:57:45 ait sshd[3873489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.55.146.40  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.83.137
description:
[2025-01-28 19:59:10 +0100] info [webmaild] 143.0.83.137 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Jan 28 20:00:42 ait sshd[3875659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 19:59:44 ait sshd[3874784]: Invalid user h1-lubricants.net 2a00 from 122.51.104.242 port 45790


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 19:59:45 ait sshd[3874784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.184.53.83
description:
Jan 28 20:00:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.184.53.83 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jan 28 19:59:44 ait kernel: php[3874791]: segfault at 0 ip 00001544cf993b8a sp 00007ffe8a3f7330 error 4 in i360.so[1544cf970000+d5000]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 19:59:45 ait sshd[3874784]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Jan 28 20:00:42 ait sshd[3875659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.195.250
description:
2025-01-28 20:00:54 dovecot_plain authenticator failed for (synonse) [65.20.195.250]:59685: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Jan 28 20:01:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-01-28 20:01:08 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:47322: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.59.15.105
description:
Jan 28 20:01:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.59.15.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.15.105
description:
2025-01-28 20:01:16 dovecot_plain authenticator failed for h-46-59-15-105.a980.priv.bahnhof.se (moodooke) [46.59.15.105]:51436: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.195.250
description:
Jan 28 20:00:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.195.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.15.96.99
description:
[2025-01-28 20:00:57 +0100] info [webmaild] 95.15.96.99 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.58
description:
2025-01-28 20:00:57 dovecot_plain authenticator failed for ([91.227.31.58]) [91.227.31.58]:58526: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ABS-FAC-0102||WPU:ABS-FAC-0102||RSV:6.65||T:APACHE||MV:20-01.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.58
description:
Jan 28 20:00:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.58 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.122.195
description:
Jan 28 20:00:44 ait sshd[3875659]: Failed password for invalid user bitcoin from 2.57.122.195 port 54976 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.215.93
description:
[2025-01-28 20:01:07 +0100] info [webmaild] 37.237.215.93 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 28 20:02:20 ait sshd[3876361]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.32.197.202
description:
[2025-01-28 20:02:17 +0100] info [webmaild] 95.32.197.202 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 28 20:02:20 ait sshd[3876361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.135
description:
Jan 28 20:02:18 ait sshd[3876357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.135 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.135
description:
Jan 28 20:02:18 ait sshd[3876357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.135


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 28 20:03:22 ait sshd[3876710]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.152.151
description:
[2025-01-28 20:03:31 +0100] info [webmaild] 177.8.152.151 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 28 20:03:22 ait sshd[3876710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.213.56
description:
[2025-01-28 20:02:59 +0100] info [webmaild] 45.234.213.56 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.177.81.72
description:
[2025-01-28 20:04:17 +0100] info [webmaild] 160.177.81.72 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 20:05:22 ait sshd[3877673]: Invalid user h1-lubricants.net 2a00 from 122.51.104.242 port 50334


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 20:05:22 ait sshd[3877673]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 20:05:22 ait sshd[3877673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.130.171
description:
[2025-01-28 20:06:23 +0100] info [webmaild] 179.125.130.171 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 28 20:05:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-28 20:05:59 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:51285: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.78
description:
Jan 28 20:07:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.78
description:
2025-01-28 20:07:37 dovecot_plain authenticator failed for (bylarte) [65.20.162.78]:48071: 535 Incorrect authentication data (set_id=abs61a11144y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS23B00103Y||WPU:ADS23B00103Y||RSV:6.65||T:APACHE||MV:20-07.170.205.31.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.112
description:
[2025-01-28 20:06:43 +0100] info [webmaild] 213.230.93.112 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.70.171.214
description:
[2025-01-28 20:06:47 +0100] info [webmaild] 103.70.171.214 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-01-28 20:08:40 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:50120: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.135
description:
Jan 28 20:08:33 ait sshd[3879229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.137.248
description:
Jan 28 20:08:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.137.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Jan 28 20:08:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.135
description:
Jan 28 20:08:33 ait sshd[3879229]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.201.104.205
description:
[2025-01-28 20:08:37 +0100] info [webmaild] 87.201.104.205 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.137.248
description:
2025-01-28 20:08:38 dovecot_plain authenticator failed for ([60.191.137.248]) [60.191.137.248]:52894: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.47
description:
2025-01-28 20:09:21 dovecot_plain authenticator failed for (avoke) [65.20.193.47]:58034: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.32.252
description:
[2025-01-28 20:09:26 +0100] info [webmaild] 191.5.32.252 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 28 20:08:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-28 20:08:56 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:48801: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.47
description:
Jan 28 20:09:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-28 20:08:52 dovecot_plain authenticator failed for ([93.182.160.222]) [93.182.160.222]:52310: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 28 20:08:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.79.85.105
description:
[2025-01-28 20:09:51 +0100] info [webmaild] 187.79.85.105 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.63.59.210
description:
[2025-01-28 20:10:38 +0100] info [webmaild] 39.63.59.210 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.7
description:
47.128.43.7 - - [28/Jan/2025:20:10:11 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22158525 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/270184?panel=request" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.7


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.3.135
description:
[2025-01-28 20:10:06 +0100] info [webmaild] 143.255.3.135 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 20:11:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.142.99.136
description:
[2025-01-28 20:11:15 +0100] info [webmaild] 102.142.99.136 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-01-28 20:11:51 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:53048: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Jan 28 20:11:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-01-28 20:12:02 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:20709: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.122.204
description:
[2025-01-28 20:12:24 +0100] info [webmaild] 169.224.122.204 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Jan 28 20:12:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-28 20:13:12 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:50771: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.148.110
description:
Jan 28 20:13:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.148.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 28 20:13:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.148.110
description:
2025-01-28 20:13:39 dovecot_plain authenticator failed for ([94.202.148.110]) [94.202.148.110]:38899: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.112.53.239
description:
[2025-01-28 20:13:02 +0100] info [webmaild] 103.112.53.239 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 20:13:25 ait sshd[3881934]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 20:13:25 ait sshd[3881934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.143
description:
Jan 28 20:13:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.143
description:
2025-01-28 20:13:43 dovecot_login authenticator failed for (mHPJgJOG) [45.154.98.143]:19284: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.140.212.144
description:
2025-01-28 20:13:56 dovecot_plain authenticator failed for ([5.140.212.144]) [5.140.212.144]:37578: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.109.96.252
description:
[2025-01-28 20:14:25 +0100] info [webmaild] 179.109.96.252 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Jan 28 20:13:48 ait sshd[3882100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Jan 28 20:13:48 ait sshd[3882100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.143
description:
Jan 28 20:13:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 28 20:13:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-28 20:13:53 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:38710: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 28 20:14:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-28 20:14:04 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (discon) [91.56.31.167]:64240: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 20:13:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-28 20:14:00 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:10583: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.143
description:
2025-01-28 20:13:49 dovecot_login authenticator failed for (0FlbWtFA) [45.154.98.143]:19442: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 28 20:13:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.140.212.144
description:
Jan 28 20:13:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.140.212.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 28 20:15:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-28 20:15:12 dovecot_plain authenticator failed for mail.schindler-statik.at (larethrof) [80.120.186.246]:42812: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 28 20:15:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-28 20:15:13 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:48822: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.253.229.114
description:
[2025-01-28 20:15:18 +0100] info [webmaild] 191.253.229.114 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 28 20:15:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-28 20:15:25 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:53560: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
description:
Jan 28 20:15:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.127.108.21
description:
[2025-01-28 20:16:13 +0100] info [webmaild] 194.127.108.21 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.204.60.149
description:
[2025-01-28 20:16:30 +0100] info [webmaild] 186.204.60.149 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Jan 28 20:15:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-01-28 20:15:47 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:40542: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.68.12.96
description:
[2025-01-28 20:16:09 +0100] info [whostmgrd] 77.68.12.96 - (http "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 20:16:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.68.12.96
description:
Jan 28 20:16:10 ait sshd[3883469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.68.12.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.41.128.150
description:
Jan 28 20:16:41 ait sshd[3883421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.41.128.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
description:
2025-01-28 20:15:57 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:48316: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.68.12.96
description:
Jan 28 20:16:10 ait sshd[3883469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.68.12.96


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.190.100
description:
Jan 28 20:17:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.190.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-28 20:17:13 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:2181: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 20:17:38 ait sshd[3884254]: Invalid user accessrentacar.com.au 2404 from 111.231.56.128 port 38584


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-28 20:17:31 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:47902: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 20:17:35 ait sshd[3884244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 20:16:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 20:17:35 ait sshd[3884244]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 20:17:38 ait sshd[3884254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.41.128.150
description:
Jan 28 20:16:43 ait sshd[3883421]: Failed password for invalid user remotessh from 118.41.128.150 port 33047 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 28 20:17:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-28 20:17:42 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:15554: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 28 20:17:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 20:17:38 ait sshd[3884254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 28 20:17:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.190.100
description:
2025-01-28 20:17:12 dovecot_plain authenticator failed for ([180.7.190.100]) [180.7.190.100]:43178: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 20:17:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.95.9
description:
Jan 28 20:17:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.95.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.9
description:
2025-01-28 20:17:04 dovecot_plain authenticator failed for ([218.23.95.9]) [218.23.95.9]:49953: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20a00227y||WPU:ads20a00227y||RSV:6.65||T:APACHE||MV:20-17.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Jan 28 20:18:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 20:18:33 ait sshd[3884770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=ftp


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.58.49
description:
[2025-01-28 20:18:00 +0100] info [webmaild] 143.0.58.49 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 28 20:18:41 ait sshd[3884807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
description:
2025-01-28 20:18:01 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:40902: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-01-28 20:18:11 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:9808: 535 Incorrect authentication data (set_id=ujakpa)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 197.243.16.120
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-18.197.243.16.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
description:
Jan 28 20:17:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 28 20:18:41 ait sshd[3884807]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.92.85.87
description:
[2025-01-28 20:18:43 +0100] info [webmaild] 201.92.85.87 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 20:18:33 ait sshd[3884770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Jan 28 20:19:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 20:19:41 ait sshd[3885335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.78.188
description:
[2025-01-28 20:18:57 +0100] info [webmaild] 45.191.78.188 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 20:19:41 ait sshd[3885335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 15.156.67.199
description:
[2025-01-28 20:20:29 +0100] info [webmaild] 15.156.67.199 - eng19a00005y@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-01-28 20:19:48 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:37710: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
description:
Jan 28 20:19:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.156.67.199
description:
2025-01-28 20:20:08 dovecot_plain authenticator failed for ec2-15-156-67-199.ca-central-1.compute.amazonaws.com (EC2AMAZ-TKBPS45.ca-central-1.compute.internal) [15.156.67.199]:56956: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.20.206
description:
47.128.20.206 - - [28/Jan/2025:20:20:11 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17354005 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?duration=medium&filter_course-language=79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.20.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-28 20:20:14 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:36930: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 28 20:20:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 20:20:57 ait sshd[3886136]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 20:20:57 ait sshd[3886136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 216.98.214.14
description:
[2025-01-28 20:21:04 +0100] info [webmaild] 216.98.214.14 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.101.209.100
description:
[2025-01-28 20:22:29 +0100] info [webmaild] 85.101.209.100 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.103.196.108
description:
[2025-01-28 20:21:55 +0100] info [webmaild] 105.103.196.108 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.28.221.21
description:
[2025-01-28 20:22:21 +0100] info [webmaild] 186.28.221.21 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.115.5
description:
[2025-01-28 20:22:54 +0100] info [webmaild] 201.148.115.5 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.166.56.76
description:
[2025-01-28 20:23:36 +0100] info [webmaild] 181.166.56.76 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.85.144
description:
[2025-01-28 20:23:20 +0100] info [webmaild] 45.227.85.144 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.163.11.11
description:
[2025-01-28 20:23:33 +0100] info [webmaild] 186.163.11.11 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.19.146.155
description:
[2025-01-28 20:25:07 +0100] info [webmaild] 191.19.146.155 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 28 20:25:46 ait sshd[3888200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ENG22B00138Y||WPU:ENG22B00138Y||RSV:6.65||T:APACHE||MV:20-26.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 20:26:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 28 20:25:46 ait sshd[3888200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 20:26:13 dovecot_plain authenticator failed for (sigly) [109.166.70.166]:3268: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.121.194.80
description:
[2025-01-28 20:26:39 +0100] info [webmaild] 186.121.194.80 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Jan 28 20:26:50 ait sshd[3888879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-27.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 20:27:31 ait sshd[3889295]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.156.192.204
description:
[2025-01-28 20:27:33 +0100] info [webmaild] 177.156.192.204 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 20:27:31 ait sshd[3889295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Jan 28 20:26:50 ait sshd[3888879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.158.97.11
description:
[2025-01-28 20:28:27 +0100] info [webmaild] 146.158.97.11 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.120.189.138
description:
[2025-01-28 20:28:40 +0100] info [webmaild] 190.120.189.138 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 20:28:42 ait sshd[3889768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 20:28:42 ait sshd[3889768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.158.114.49
description:
[2025-01-28 20:29:02 +0100] info [webmaild] 177.158.114.49 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 28 20:28:44 ait sshd[3889768]: Failed password for invalid user ijari from 210.180.118.166 port 44014 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 20:30:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.51
description:
47.128.118.51 - - [28/Jan/2025:20:31:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8448680 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=120%2C99%2C79%2C198%2C118&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.51


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.187.42.39
description:
[2025-01-28 20:31:03 +0100] info [webmaild] 191.187.42.39 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.231.222
description:
[2025-01-28 20:31:04 +0100] info [webmaild] 45.173.231.222 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.152
description:
Jan 28 20:32:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
description:
2025-01-28 20:32:16 dovecot_plain authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:45877: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 28 20:31:56 ait sshd[3891267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 28 20:31:56 ait sshd[3891267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Jan 28 20:32:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-01-28 20:32:06 dovecot_plain authenticator failed for ([177.174.122.213]) [177.174.122.213]:48504: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 28 20:32:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-28 20:33:00 dovecot_plain authenticator failed for (preened) [94.140.210.134]:48951: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.219.117.250
description:
[2025-01-28 20:33:16 +0100] info [webmaild] 190.219.117.250 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
description:
Jan 28 20:34:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.198.37.128
description:
2025-01-28 20:33:59 dovecot_plain authenticator failed for ([116.198.37.128]) [116.198.37.128]:60268: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.80.99.36
description:
[2025-01-28 20:34:00 +0100] info [webmaild] 201.80.99.36 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 28 20:34:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-28 20:34:15 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:50766: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.222.32
description:
[2025-01-28 20:34:27 +0100] info [webmaild] 45.173.222.32 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-01-28 20:34:27 dovecot_plain authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:45186: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.45.49
description:
[2025-01-28 20:34:43 +0100] info [webmaild] 45.188.45.49 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
description:
2025-01-28 20:34:43 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:34324: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.139.100
description:
[2025-01-28 20:34:33 +0100] info [webmaild] 179.125.139.100 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.228.48
description:
[2025-01-28 20:35:10 +0100] info [webmaild] 45.71.228.48 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.239.39
description:
[2025-01-28 20:35:14 +0100] info [webmaild] 143.208.239.39 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 20:36:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.74.161.107
description:
Jan 28 20:36:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.74.161.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.74.161.107
description:
2025-01-28 20:36:30 dovecot_plain authenticator failed for 37-74-161-107.biz.kpn.net [37.74.161.107]:45026: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 20:36:21 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:42913: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 28 20:36:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.243
description:
47.128.99.243 - - [28/Jan/2025:20:36:19 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27189551 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?duration=medium&filter_course-language=183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.243


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 28 20:36:59 ait sshd[3893470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.205.169
description:
[2025-01-28 20:37:00 +0100] info [webmaild] 143.255.205.169 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.112.206.53
description:
Jan 28 20:37:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.112.206.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.206.53
description:
2025-01-28 20:37:27 dovecot_plain authenticator failed for p163054-obmd01.osaka.ocn.ne.jp [61.112.206.53]:52651: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-28 20:37:39 dovecot_plain authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:51686: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.172.61.145
description:
Jan 28 20:36:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.172.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
description:
2025-01-28 20:36:50 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:44114: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 28 20:36:59 ait sshd[3893470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 28 20:37:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 28 20:37:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-28 20:37:54 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:51690: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.157.176.29
description:
Jan 28 20:38:29 ait sshd[3894116]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.157.176.29 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.157.176.29
description:
Jan 28 20:38:29 ait sshd[3894116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.176.29  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.191.117.125
description:
[2025-01-28 20:38:32 +0100] info [webmaild] 177.191.117.125 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 28 20:39:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
description:
Jan 28 20:39:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
description:
2025-01-28 20:39:15 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (suped) [78.68.37.25]:41468: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.235.75
description:
Jan 28 20:39:05 ait sshd[3894377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.235.75


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Jan 28 20:39:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-28 20:39:24 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:49386: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.120.175.158
description:
[2025-01-28 20:39:39 +0100] info [webmaild] 146.120.175.158 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.43.235.75
description:
Jan 28 20:39:05 ait sshd[3894377]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.43.235.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-01-28 20:39:12 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:50587: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.200.187.15
description:
[2025-01-28 20:39:58 +0100] info [webmaild] 149.200.187.15 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.195.146
description:
Jan 28 20:39:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.4.195.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.253
description:
Jan 28 20:40:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.253
description:
2025-01-28 20:40:12 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:59911: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.184.107.21
description:
[2025-01-28 20:40:33 +0100] info [webmaild] 197.184.107.21 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 20:39:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.152.88
description:
Jan 28 20:39:46 ait sshd[3894635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.152.88


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.152.88
description:
Jan 28 20:39:46 ait sshd[3894635]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.4.195.146
description:
2025-01-28 20:40:01 dovecot_plain authenticator failed for (ip146.ip-142-4-195.net) [142.4.195.146]:37468: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.235.226.143
description:
[2025-01-28 20:40:28 +0100] info [webmaild] 91.235.226.143 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Jan 28 20:42:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 20:42:08 ait sshd[3895770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 20:42:08 ait sshd[3895770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.157.176.29
description:
Jan 28 20:43:30 ait sshd[3896214]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.157.176.29 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.157.176.29
description:
Jan 28 20:43:30 ait sshd[3896214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.176.29


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.227.192.215
description:
[2025-01-28 20:43:05 +0100] info [webmaild] 88.227.192.215 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 28 20:43:05 ait sshd[3896103]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 28 20:43:05 ait sshd[3896103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.31.113
description:
[2025-01-28 20:43:13 +0100] info [webmaild] 170.233.31.113 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.91.154.187
description:
Jan 28 20:43:15 ait sshd[3896127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.91.154.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 20:43:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 20:44:22 ait sshd[3896538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 20:44:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.202.153
description:
Jan 28 20:44:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.202.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 20:44:22 ait sshd[3896538]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.202.153
description:
2025-01-28 20:44:38 dovecot_plain authenticator failed for 78-73-202-153-no2665.tbcn.telia.com (combism) [78.73.202.153]:55076: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 20:44:43 ait sshd[3896715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.91.154.187
description:
Jan 28 20:45:19 ait sshd[3897056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.91.154.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.90.81.192
description:
[2025-01-28 20:45:30 +0100] info [webmaild] 45.90.81.192 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.98.158.24
description:
[2025-01-28 20:45:37 +0100] info [webmaild] 176.98.158.24 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 20:44:43 ait sshd[3896715]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.43.235.75
description:
Jan 28 20:45:48 ait sshd[3897331]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.43.235.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.235.75
description:
Jan 28 20:45:48 ait sshd[3897331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.235.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.170.182.231
description:
[2025-01-28 20:46:34 +0100] info [webmaild] 178.170.182.231 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.44.115.163
description:
[2025-01-28 20:46:05 +0100] info [webmaild] 110.44.115.163 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-01-28 20:48:25 dovecot_plain authenticator failed for (pulle) [84.238.92.245]:42626: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 28 20:47:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-28 20:47:51 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:35872: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Jan 28 20:47:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-01-28 20:47:58 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:56048: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Jan 28 20:48:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.157.176.29
description:
Jan 28 20:49:25 ait sshd[3898963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.176.29


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 20:49:30 ait sshd[3899053]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.194.230
description:
[2025-01-28 20:49:08 +0100] info [webmaild] 45.187.194.230 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.157.176.29
description:
Jan 28 20:49:25 ait sshd[3898963]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.157.176.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 20:49:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 20:49:30 ait sshd[3899053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 28 20:50:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-28 20:50:08 dovecot_plain authenticator failed for ([90.161.217.228]) [90.161.217.228]:51373: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 20:50:18 +0100] info [cpaneld] 217.160.25.51 - www.lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user www.lemsas.net (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 28 20:50:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-28 20:50:29 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:58878: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 20:50:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.217.93.66
description:
[2025-01-28 20:50:31 +0100] info [webmaild] 179.217.93.66 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.111.195
description:
[2025-01-28 20:51:05 +0100] info [webmaild] 201.182.111.195 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.88.108
description:
[2025-01-28 20:51:48 +0100] info [webmaild] 45.70.88.108 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.43.235.75
description:
Jan 28 20:52:35 ait sshd[3900442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.43.235.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.35.74.45
description:
[2025-01-28 20:52:35 +0100] info [webmaild] 197.35.74.45 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.244
description:
47.128.122.244 - - [28/Jan/2025:20:51:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11500820 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/info.php?id=485" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.244


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.235.75
description:
Jan 28 20:52:35 ait sshd[3900442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.235.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.223.134.56
description:
[2025-01-28 20:52:44 +0100] info [webmaild] 31.223.134.56 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 20:54:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-28 20:55:26 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:1218: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:eng17a00074Y||WPU:eng17a00074Y||RSV:6.65||T:APACHE||MV:20-55.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 28 20:55:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Jan 28 20:55:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 28 20:55:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-28 20:55:34 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:35542: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.164.160
description:
[2025-01-28 20:55:43 +0100] info [webmaild] 45.173.164.160 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.178
description:
Jan 28 20:55:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 20:55:05 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:59798: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.178
description:
2025-01-28 20:55:20 dovecot_plain authenticator failed for 83-233-71-178.cust.bredband2.com [83.233.71.178]:35114: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 28 20:55:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.9.119.167
description:
[2025-01-28 20:55:07 +0100] info [webmaild] 95.9.119.167 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.149.82.168
description:
[2025-01-28 20:56:28 +0100] info [webmaild] 46.149.82.168 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 20:56:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-01-28 20:55:46 dovecot_plain authenticator failed for ([59.97.139.38]) [59.97.139.38]:36207: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 20:55:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.82
description:
2025-01-28 20:57:20 dovecot_plain authenticator failed for ([63.65.203.82]) [63.65.203.82]:34651: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.26.254
description:
[2025-01-28 20:57:38 +0100] info [webmaild] 187.19.26.254 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 28 20:57:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-28 20:57:11 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:45247: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.65.203.82
description:
Jan 28 20:57:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.65.203.82 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 20:58:04 ait sshd[3903188]: Invalid user accessrentacar.com.au 2404 from 111.231.56.128 port 57880


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 20:58:05 ait sshd[3903188]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 20:58:05 ait sshd[3903188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.74.5.224
description:
[2025-01-28 20:58:14 +0100] info [webmaild] 201.74.5.224 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.247.78
description:
[2025-01-28 20:59:29 +0100] info [webmaild] 177.93.247.78 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
description:
Jan 28 20:59:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
description:
2025-01-28 20:59:39 dovecot_plain authenticator failed for (blyfly) [37.139.110.118]:49200: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.61.56
description:
[2025-01-28 20:58:46 +0100] info [webmaild] 177.222.61.56 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 20:58:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.245.96.66
description:
[2025-01-28 20:59:16 +0100] info [webmaild] 109.245.96.66 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-28 20:59:15 dovecot_plain authenticator failed for (promely) [77.51.214.170]:45721: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.155.205.213
description:
[2025-01-28 20:59:44 +0100] info [webmaild] 177.155.205.213 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 20:59:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 20:59:02 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (huriath) [81.225.30.107]:60182: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 28 20:59:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 28 20:59:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
description:
Jan 28 21:00:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
description:
2025-01-28 21:00:13 dovecot_plain authenticator failed for ([111.53.52.116]) [111.53.52.116]:59766: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 28 21:00:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-28 21:00:24 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:3781: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Jan 28 21:01:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-01-28 21:01:30 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:40139: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.218.17
description:
[2025-01-28 21:01:05 +0100] info [webmaild] 45.237.218.17 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
description:
Jan 28 21:01:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
description:
2025-01-28 21:01:19 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:33563: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.174.113
description:
[2025-01-28 21:02:28 +0100] info [webmaild] 119.160.174.113 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.133.196
description:
2025-01-28 21:02:34 dovecot_plain authenticator failed for ([65.76.133.196]) [65.76.133.196]:36170: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.133.196
description:
Jan 28 21:02:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.133.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.71.78.143
description:
[2025-01-28 21:01:57 +0100] info [webmaild] 177.71.78.143 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Jan 28 21:02:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-01-28 21:02:19 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:58984: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Jan 28 21:03:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-01-28 21:03:05 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:57546: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Jan 28 21:02:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-01-28 21:02:56 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:54707: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-28 21:03:32 dovecot_plain authenticator failed for (fiend) [65.20.205.197]:46813: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-03.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 21:03:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 28 21:03:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.214.70.132
description:
[2025-01-28 21:04:29 +0100] info [webmaild] 179.214.70.132 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-01-28 21:04:40 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:44713: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.157.192.234
description:
[2025-01-28 21:03:58 +0100] info [webmaild] 93.157.192.234 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Jan 28 21:04:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.183.73
description:
Jan 28 21:04:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.183.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.183.73
description:
2025-01-28 21:04:52 dovecot_plain authenticator failed for ([117.158.183.73]) [117.158.183.73]:48135: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.111
description:
Jan 28 21:05:37 ait sshd[3906665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 28 21:05:37 ait sshd[3906665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.239.125
description:
[2025-01-28 21:04:54 +0100] info [webmaild] 170.254.239.125 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 21:05:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
description:
2025-01-28 21:06:17 dovecot_plain authenticator failed for (mensh) [65.20.250.163]:48719: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.123.72.205
description:
Jan 28 21:06:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.123.72.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.163
description:
Jan 28 21:06:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 21:06:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.95.216
description:
Jan 28 21:06:31 ait sshd[3907182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.95.216  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 21:06:20 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (pulews) [51.255.84.180]:56962: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.58
description:
Jan 28 21:06:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
description:
2025-01-28 21:06:35 dovecot_plain authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:61242: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.123.72.205
description:
2025-01-28 21:06:38 dovecot_plain authenticator failed for ([187.123.72.205]) [187.123.72.205]:52038: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Jan 28 21:06:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-28 21:06:48 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:51718: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.239.25.63
description:
[2025-01-28 21:07:24 +0100] info [webmaild] 193.239.25.63 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-01-28 21:06:46 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:38904: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.235.161.188
description:
[2025-01-28 21:07:24 +0100] info [webmaild] 45.235.161.188 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 28 21:06:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.237.219.98
description:
[2025-01-28 21:08:11 +0100] info [webmaild] 176.237.219.98 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-28 21:08:01 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:37544: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Jan 28 21:08:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
description:
2025-01-28 21:07:46 dovecot_plain authenticator failed for (nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:51122: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 28 21:07:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
description:
Jan 28 21:07:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.95.216
description:
Jan 28 21:09:02 ait sshd[3908410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.95.216  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.114.231
description:
2025-01-28 21:09:43 dovecot_plain authenticator failed for ([90.188.114.231]) [90.188.114.231]:34745: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.114.231
description:
Jan 28 21:09:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.114.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 21:09:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.150.75.22
description:
[2025-01-28 21:09:49 +0100] info [webmaild] 46.150.75.22 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.30.139.251
description:
2025-01-28 21:10:01 dovecot_plain authenticator failed for ([120.55.170.138]) [116.30.139.251]:5836: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.192.203
description:
[2025-01-28 21:10:24 +0100] info [webmaild] 198.163.192.203 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.30.139.251
description:
Jan 28 21:09:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.30.139.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.99
description:
47.128.16.99 - - [28/Jan/2025:21:10:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26091070 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C125%2C30%2C205&filter_course-language=121&filtering=1&instructor=1%2C2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.99


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.112.246.217
description:
2025-01-28 21:10:56 dovecot_plain authenticator failed for ([222.112.246.217]) [222.112.246.217]:33388: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Jan 28 21:11:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.112.246.217
description:
Jan 28 21:10:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.112.246.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.205.115.52
description:
[2025-01-28 21:10:54 +0100] info [webmaild] 37.205.115.52 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-01-28 21:11:05 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:60524: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.180.212.97
description:
[2025-01-28 21:11:21 +0100] info [webmaild] 187.180.212.97 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.212.215
description:
[2025-01-28 21:11:35 +0100] info [webmaild] 168.232.212.215 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 21:12:32 ait sshd[3910132]: Invalid user accessrentacar.com.au 2404 from 111.231.56.128 port 51932


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 21:12:34 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:59728: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 21:12:07 ait sshd[3909915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 21:12:07 ait sshd[3909915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
description:
Jan 28 21:12:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-01-28 21:12:29 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:6285: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 21:12:32 ait sshd[3910132]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 21:12:32 ait sshd[3910132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.232.133.132
description:
[2025-01-28 21:11:58 +0100] info [webmaild] 186.232.133.132 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
description:
2025-01-28 21:12:06 dovecot_login authenticator failed for (119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:45052: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-01-28 21:12:18 dovecot_login authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:37227: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
description:
2025-01-28 21:12:20 dovecot_plain authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:43668: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 21:12:48 ait sshd[3910182]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 21:12:48 ait sshd[3910182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.162.66
description:
[2025-01-28 21:13:04 +0100] info [webmaild] 90.156.162.66 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-01-28 21:12:45 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:59149: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.136.232
description:
[2025-01-28 21:12:59 +0100] info [webmaild] 41.56.136.232 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.31.204.83
description:
[2025-01-28 21:14:38 +0100] info [webmaild] 189.31.204.83 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 21:14:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.64.20
description:
2025-01-28 21:13:51 dovecot_login authenticator failed for ([94.207.64.20]) [94.207.64.20]:60020: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.180.100.38
description:
Jan 28 21:14:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.180.100.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.238.104.74
description:
2025-01-28 21:14:41 dovecot_login authenticator failed for ([124.238.104.74]) [124.238.104.74]:18996: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.180.100.38
description:
2025-01-28 21:14:03 dovecot_login authenticator failed for 45-180-100-38.dynamic.tecnettelecom.net [45.180.100.38]:56296: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 21:14:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-28 21:15:30 dovecot_login authenticator failed for ([103.182.161.206]) [103.182.161.206]:33612: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ENG20A00069Y||WPU:ENG20A00069Y||RSV:6.65||T:APACHE||MV:21-15.170.205.31.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-01-28 21:15:21 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:50358: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 28 21:15:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Jan 28 21:15:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Jan 28 21:15:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
description:
2025-01-28 21:15:12 dovecot_login authenticator failed for ([201.183.225.156]) [201.183.225.156]:56858: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 21:15:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
description:
Jan 28 21:14:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Jan 28 21:15:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
description:
2025-01-28 21:15:32 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:42438: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Jan 28 21:15:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
description:
2025-01-28 21:15:00 dovecot_login authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:43546: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-01-28 21:15:14 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:33606: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.204
description:
Jan 28 21:15:17 ait sshd[3911142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.204  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 28 21:15:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-28 21:15:40 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:2484: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.204
description:
2025-01-28 21:14:54 dovecot_login authenticator failed for ([220.179.87.204]) [220.179.87.204]:52585: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-01-28 21:15:07 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:36817: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-01-28 21:15:20 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:30294: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
description:
Jan 28 21:15:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-28 21:15:30 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:46430: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.111
description:
2025-01-28 21:14:51 dovecot_login authenticator failed for ([14.21.36.111]) [14.21.36.111]:46122: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
description:
Jan 28 21:15:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.56.83
description:
2025-01-28 21:15:43 dovecot_login authenticator failed for ([94.201.56.83]) [94.201.56.83]:50888: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.204
description:
Jan 28 21:15:17 ait sshd[3911142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 28 21:15:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.201.56.83
description:
Jan 28 21:15:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.201.56.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-28 21:15:02 dovecot_login authenticator failed for ([200.165.163.121]) [200.165.148.166]:45100: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Jan 28 21:15:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 21:16:27 ait sshd[3911791]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.159.114
description:
Jan 28 21:15:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.159.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
description:
Jan 28 21:16:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
description:
Jan 28 21:15:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
description:
2025-01-28 21:15:53 dovecot_login authenticator failed for ([221.10.221.104]) [221.10.221.104]:59358: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.159.114
description:
2025-01-28 21:15:55 dovecot_login authenticator failed for p88115-obmd01.osaka.ocn.ne.jp [180.7.159.114]:49852: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
description:
2025-01-28 21:16:04 dovecot_login authenticator failed for ([103.146.233.121]) [103.146.233.121]:60452: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.241.70.182
description:
[2025-01-28 21:16:11 +0100] info [webmaild] 88.241.70.182 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-01-28 21:16:13 dovecot_login authenticator failed for ([58.230.236.86]) [58.230.236.86]:51914: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 21:15:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.235.246
description:
[2025-01-28 21:16:38 +0100] info [webmaild] 170.231.235.246 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 21:16:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Jan 28 21:16:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 21:16:27 ait sshd[3911791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
description:
Jan 28 21:15:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
description:
2025-01-28 21:15:51 dovecot_login authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:53613: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 21:17:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.7.2.96
description:
[2025-01-28 21:17:25 +0100] info [webmaild] 38.7.2.96 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 21:17:24 dovecot_plain authenticator failed for (eurcuebed) [81.211.77.58]:34365: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.86.7.65
description:
Jan 28 21:17:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.86.7.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-28 21:17:38 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:40376: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 21:16:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-01-28 21:17:18 dovecot_plain authenticator failed for ([60.221.215.232]) [60.221.215.232]:48735: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 21:17:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
description:
2025-01-28 21:17:35 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:34203: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 28 21:17:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
description:
Jan 28 21:17:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.155
description:
Jan 28 21:17:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
description:
Jan 28 21:17:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-01-28 21:18:00 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:56064: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
description:
2025-01-28 21:18:00 dovecot_plain authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:47258: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.193.57.76
description:
[2025-01-28 21:18:37 +0100] info [webmaild] 186.193.57.76 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.155
description:
2025-01-28 21:17:47 dovecot_plain authenticator failed for ([166.195.195.155]) [166.195.195.155]:34401: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Jan 28 21:17:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
description:
Jan 28 21:18:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
description:
2025-01-28 21:18:10 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:53646: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.12.253.64
description:
[2025-01-28 21:19:27 +0100] info [webmaild] 181.12.253.64 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 28 21:19:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-28 21:19:46 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (balationis) [54.38.80.107]:58952: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 21:20:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.40.89.176
description:
[2025-01-28 21:20:24 +0100] info [webmaild] 189.40.89.176 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 21:20:32 ait sshd[3913861]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 21:20:32 ait sshd[3913861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-28 21:21:59 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:58706: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
description:
Jan 28 21:22:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.37.139
description:
[2025-01-28 21:22:26 +0100] info [webmaild] 131.72.37.139 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.118.123
description:
2025-01-28 21:22:33 dovecot_plain authenticator failed for ([60.174.118.123]) [60.174.118.123]:55867: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 21:21:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.165.122.8
description:
[2025-01-28 21:21:55 +0100] info [webmaild] 165.165.122.8 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
description:
2025-01-28 21:22:10 dovecot_login authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:38825: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
description:
2025-01-28 21:22:17 dovecot_login authenticator failed for ([222.190.110.210]) [222.190.110.210]:55115: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 28 21:22:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-28 21:22:29 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:54713: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 28 21:21:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
description:
Jan 28 21:22:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.118.123
description:
Jan 28 21:22:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.118.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.112.141.230
description:
Jan 28 21:22:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.112.141.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Jan 28 21:23:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-01-28 21:23:11 dovecot_login authenticator failed for ([112.196.60.13]) [112.196.60.13]:57788: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.109.48.10
description:
[2025-01-28 21:22:54 +0100] info [webmaild] 187.109.48.10 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
description:
Jan 28 21:22:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-01-28 21:23:00 dovecot_login authenticator failed for ([60.171.237.143]) [60.171.237.143]:53555: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
description:
2025-01-28 21:23:01 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:55778: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.254.191.35
description:
[2025-01-28 21:23:06 +0100] info [webmaild] 109.254.191.35 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.134.217.186
description:
[2025-01-28 21:23:37 +0100] info [webmaild] 103.134.217.186 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 21:24:22 ait sshd[3915600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.52.136
description:
[2025-01-28 21:23:51 +0100] info [webmaild] 37.239.52.136 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.75.138
description:
[2025-01-28 21:23:52 +0100] info [webmaild] 45.179.75.138 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 21:24:22 ait sshd[3915600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.189.10.106
description:
[2025-01-28 21:24:52 +0100] info [webmaild] 191.189.10.106 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 21:25:09 +0100] info [cpaneld] 217.160.25.51 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 21:25:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.178.119.62
description:
[2025-01-28 21:26:26 +0100] info [webmaild] 45.178.119.62 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 28 21:26:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
description:
Jan 28 21:26:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
description:
2025-01-28 21:26:24 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:49171: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-28 21:26:42 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:36015: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 28 21:28:02 ait sshd[3917422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.244.154.210
description:
[2025-01-28 21:28:12 +0100] info [webmaild] 185.244.154.210 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.224.130.120
description:
Jan 28 21:28:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.224.130.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.144.119.80
description:
[2025-01-28 21:28:26 +0100] info [webmaild] 197.144.119.80 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 21:28:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.183.194.220
description:
[2025-01-28 21:29:15 +0100] info [webmaild] 38.183.194.220 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.118.62.57
description:
[2025-01-28 21:29:36 +0100] info [webmaild] 200.118.62.57 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 21:30:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.232.231
description:
[2025-01-28 21:31:25 +0100] info [webmaild] 45.229.232.231 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Jan 28 21:32:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.141.106
description:
2025-01-28 21:32:22 dovecot_login authenticator failed for ([87.236.141.106]) [87.236.141.106]:57616: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-01-28 21:32:05 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:51600: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 209.14.22.215
description:
[2025-01-28 21:32:16 +0100] info [webmaild] 209.14.22.215 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.236.141.106
description:
Jan 28 21:32:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.236.141.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 21:32:21 ait sshd[3919295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.237.194
description:
2025-01-28 21:33:32 dovecot_plain authenticator failed for p50194-obmd01.osaka.ocn.ne.jp [153.141.237.194]:56909: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.40.63
description:
2025-01-28 21:33:39 dovecot_plain authenticator failed for c188-150-40-63.bredband.tele2.se (prousial) [188.150.40.63]:56162: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.237.194
description:
Jan 28 21:33:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.237.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.21.113
description:
2025-01-28 21:33:30 dovecot_login authenticator failed for ([117.158.21.113]) [117.158.21.113]:39475: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-28 21:33:31 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:43996: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.120.97
description:
2025-01-28 21:33:41 dovecot_login authenticator failed for v2202501250131308547.bestsrv.de [152.53.120.97]:47904: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.21.113
description:
Jan 28 21:33:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.21.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 28 21:33:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.40.63
description:
Jan 28 21:33:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.40.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.120.97
description:
Jan 28 21:33:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.120.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
description:
2025-01-28 21:33:54 dovecot_login authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:46637: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.196.60.148
description:
2025-01-28 21:33:58 dovecot_plain authenticator failed for (posomble) [156.196.60.148]:38792: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
description:
Jan 28 21:34:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.223.168.193
description:
Jan 28 21:33:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.223.168.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.166.225.61
description:
[2025-01-28 21:33:47 +0100] info [webmaild] 38.166.225.61 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Jan 28 21:33:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.5.43.162
description:
[2025-01-28 21:34:27 +0100] info [webmaild] 187.5.43.162 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.1.55.75
description:
[2025-01-28 21:34:37 +0100] info [webmaild] 197.1.55.75 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-01-28 21:34:41 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:57542: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 21:33:51 ait sshd[3920036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 21:34:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Jan 28 21:34:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-28 21:33:45 dovecot_plain authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:61201: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
description:
2025-01-28 21:33:51 dovecot_login authenticator failed for ([182.139.39.150]) [182.139.39.150]:56798: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.196.60.148
description:
Jan 28 21:33:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.196.60.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-01-28 21:33:52 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:40436: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 28 21:34:18 ait sshd[3920179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
description:
2025-01-28 21:34:34 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:58171: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
description:
Jan 28 21:33:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
description:
Jan 28 21:33:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 28 21:33:51 ait sshd[3920036]: Invalid user universitypublishing from 210.180.118.166 port 40652


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Jan 28 21:34:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-01-28 21:34:53 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:38826: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
description:
Jan 28 21:34:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-01-28 21:34:59 dovecot_plain authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:57267: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.27.44
description:
47.128.27.44 - - [28/Jan/2025:21:34:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16789425 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C95%2C79%2C198&filtering=1&instructor=2&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.27.44


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.207.197
description:
[2025-01-28 21:35:13 +0100] info [webmaild] 177.54.207.197 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
description:
2025-01-28 21:35:17 dovecot_login authenticator failed for ([119.207.83.89]) [119.207.83.89]:45241: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.127.121.185
description:
[2025-01-28 21:35:34 +0100] info [webmaild] 77.127.121.185 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.141.175.179
description:
[2025-01-28 21:34:53 +0100] info [webmaild] 41.141.175.179 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.83.89
description:
Jan 28 21:35:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.83.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
description:
2025-01-28 21:35:18 dovecot_plain authenticator failed for ([60.2.203.254]) [60.2.203.254]:47454: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.2.203.254
description:
Jan 28 21:35:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.2.203.254 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:BSCJ20BOSHRM0016Y||WPU:BSCJ20BOSHRM0016Y||RSV:6.65||T:APACHE||MV:21-35.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
description:
Jan 28 21:35:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.205
description:
2025-01-28 21:35:53 dovecot_plain authenticator failed for (patiouk) [65.20.155.205]:40899: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.39.151.164
description:
[2025-01-28 21:35:49 +0100] info [webmaild] 187.39.151.164 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.111.250
description:
[2025-01-28 21:36:57 +0100] info [webmaild] 45.191.111.250 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 21:38:09 ait sshd[3922097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.228.131
description:
2025-01-28 21:38:41 dovecot_plain authenticator failed for ([183.99.228.131]) [183.99.228.131]:52775: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.201.148.45
description:
[2025-01-28 21:38:08 +0100] info [webmaild] 46.201.148.45 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 21:38:09 ait sshd[3922097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-28 21:38:05 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:53592: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 28 21:38:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.245
description:
Jan 28 21:38:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.245
description:
2025-01-28 21:38:38 dovecot_plain authenticator failed for ([221.149.233.245]) [221.149.233.245]:40376: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.228.131
description:
Jan 28 21:38:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.228.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 21:38:14 ait sshd[3922309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 21:39:31 ait sshd[3922879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
description:
2025-01-28 21:39:34 dovecot_plain authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:56267: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.33.79
description:
Jan 28 21:39:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.33.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
description:
Jan 28 21:38:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-01-28 21:38:51 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:42160: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Jan 28 21:38:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
description:
2025-01-28 21:38:49 dovecot_plain authenticator failed for ([1.26.70.70]) [1.26.70.70]:19023: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Jan 28 21:38:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-01-28 21:39:00 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:43661: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-39.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.143
description:
Jan 28 21:40:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 28 21:39:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-28 21:39:50 dovecot_plain authenticator failed for ([82.84.122.203]) [82.84.122.203]:64312: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.212.183.97
description:
2025-01-28 21:39:53 dovecot_plain authenticator failed for ([182.212.183.97]) [182.212.183.97]:59189: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.6.55.57
description:
Jan 28 21:40:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.6.55.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Jan 28 21:39:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 21:40:25 ait sshd[3923026]: Invalid user accessrentacar.com.au 2404 from 111.231.56.128 port 41772


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 21:40:25 ait sshd[3923026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
description:
Jan 28 21:40:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.87.237
description:
2025-01-28 21:40:01 dovecot_plain authenticator failed for ([61.150.87.237]) [61.150.87.237]:33359: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.205.196
description:
[2025-01-28 21:40:09 +0100] info [webmaild] 45.163.205.196 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.17.116
description:
[2025-01-28 21:40:18 +0100] info [webmaild] 177.12.17.116 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
description:
2025-01-28 21:40:25 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:37042: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-01-28 21:39:57 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:46396: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-28 21:40:37 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:53314: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.212.183.97
description:
Jan 28 21:39:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.212.183.97 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.52.178
description:
47.128.52.178 - - [28/Jan/2025:21:40:08 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13753039" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
description:
2025-01-28 21:40:18 dovecot_plain authenticator failed for ([119.6.55.57]) [119.6.55.57]:37112: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 28 21:40:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.87.237
description:
Jan 28 21:39:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.87.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.178
description:
[2025-01-28 21:40:01 +0100] info [webmaild] 84.54.71.178 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.143
description:
2025-01-28 21:40:29 dovecot_plain authenticator failed for ([122.187.227.143]) [122.187.227.143]:49203: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 28 21:40:43 ait sshd[3923683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 28 21:40:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
description:
Jan 28 21:40:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 28 21:41:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-28 21:40:51 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:31882: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
description:
2025-01-28 21:40:53 dovecot_plain authenticator failed for ([213.230.127.217]) [213.230.127.217]:50466: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-28 21:41:03 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:47888: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.25.120
description:
[2025-01-28 21:41:34 +0100] info [webmaild] 168.197.25.120 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Jan 28 21:42:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
description:
Jan 28 21:42:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-01-28 21:42:07 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:44539: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
description:
Jan 28 21:42:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-01-28 21:42:18 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:44041: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-01-28 21:42:31 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:45666: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 28 21:43:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 28 21:43:31 ait sshd[3924803]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 28 21:43:31 ait sshd[3924803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 28 21:43:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.21.36.101
description:
Jan 28 21:42:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.21.36.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.101
description:
2025-01-28 21:42:54 dovecot_plain authenticator failed for ([14.21.36.101]) [14.21.36.101]:38338: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.232.159.33
description:
[2025-01-28 21:43:21 +0100] info [webmaild] 190.232.159.33 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.240.117.170
description:
Jan 28 21:44:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.240.117.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.62.146.108
description:
[2025-01-28 21:44:12 +0100] info [webmaild] 5.62.146.108 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.246.240.83
description:
Jan 28 21:44:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.246.240.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Jan 28 21:44:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 28 21:43:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.246.240.83
description:
2025-01-28 21:44:28 dovecot_plain authenticator failed for (esedned) [213.246.240.83]:45694: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 28 21:44:13 ait sshd[3925127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 28 21:44:13 ait sshd[3925127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
description:
2025-01-28 21:46:07 dovecot_login authenticator failed for ([178.178.222.53]) [178.178.222.53]:46188: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.139.234.137
description:
[2025-01-28 21:46:22 +0100] info [webmaild] 41.139.234.137 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 159.65.188.122
description:
[2025-01-28 21:45:47 +0100] info [whostmgrd] 159.65.188.122 - ait "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.173.215.146
description:
[2025-01-28 21:45:49 +0100] info [webmaild] 179.173.215.146 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.46
description:
2025-01-28 21:45:49 dovecot_login authenticator failed for ([61.185.226.46]) [61.185.226.46]:51881: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 28 21:45:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-28 21:45:52 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:52938: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Jan 28 21:45:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 28 21:45:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.46
description:
Jan 28 21:45:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
description:
2025-01-28 21:45:46 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:52072: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Jan 28 21:46:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 28 21:45:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
description:
Jan 28 21:45:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-01-28 21:45:44 dovecot_login authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:46294: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-28 21:45:49 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:43165: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
description:
Jan 28 21:46:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-01-28 21:46:09 dovecot_login authenticator failed for ([111.48.214.96]) [111.48.214.96]:43498: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.81.2
description:
Jan 28 21:45:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.81.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.81.2
description:
2025-01-28 21:45:45 dovecot_login authenticator failed for ([65.76.81.2]) [65.76.81.2]:37512: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.100.197.25
description:
[2025-01-28 21:46:59 +0100] info [webmaild] 102.100.197.25 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.77.198.101
description:
[2025-01-28 21:47:28 +0100] info [webmaild] 186.77.198.101 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.102.150.106
description:
[2025-01-28 21:46:47 +0100] info [webmaild] 201.102.150.106 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.149.46
description:
2025-01-28 21:47:48 dovecot_plain authenticator failed for (xaters) [109.166.149.46]:54478: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.134.32.74
description:
2025-01-28 21:48:36 dovecot_plain authenticator failed for ([222.134.32.74]) [222.134.32.74]:47092: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 21:47:44 ait sshd[3927253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.149.46
description:
Jan 28 21:47:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.149.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.213.29
description:
Jan 28 21:47:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-01-28 21:48:01 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:41290: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.134.32.74
description:
Jan 28 21:48:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.134.32.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.213.29
description:
2025-01-28 21:47:50 dovecot_plain authenticator failed for (host-29.213.77.5.ucom.am) [5.77.213.29]:55074: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 21:47:44 ait sshd[3927253]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Jan 28 21:47:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
description:
Jan 28 21:48:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-01-28 21:48:18 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:55026: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.12.33.220
description:
[2025-01-28 21:47:54 +0100] info [webmaild] 198.12.33.220 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.142.233.176
description:
[2025-01-28 21:48:43 +0100] info [webmaild] 41.142.233.176 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 21:49:29 ait sshd[3928009]: Invalid user accessrentacar.com.au 2404 from 111.231.56.128 port 47012


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 21:49:29 ait sshd[3928009]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 21:49:29 ait sshd[3928009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.249.65.11
description:
[2025-01-28 21:50:07 +0100] info [webmaild] 167.249.65.11 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 28 21:50:53 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Jan 28 21:50:43 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-01-28 21:50:45 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:43227: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.57.34
description:
[2025-01-28 21:50:50 +0100] info [webmaild] 91.106.57.34 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-28 21:50:55 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:49505: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Jan 28 21:52:02 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-01-28 21:52:04 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (unceny) [188.127.16.197]:46338: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.185.79.38
description:
[2025-01-28 21:52:07 +0100] info [webmaild] 191.185.79.38 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.70.96
description:
[2025-01-28 21:52:19 +0100] info [webmaild] 170.84.70.96 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.170.31
description:
[2025-01-28 21:53:16 +0100] info [webmaild] 45.228.170.31 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 28 21:52:45 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-28 21:52:47 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (andlach) [91.56.31.167]:61377: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 28 21:53:49 ait sshd[3930455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20b00337y||WPU:ads20b00337y||RSV:6.65||T:APACHE||MV:21-54.170.205.31.106


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.227.84.75
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-54.165.227.84.75


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 28 21:53:49 ait sshd[3930455]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.22.189
description:
[2025-01-28 21:55:30 +0100] info [webmaild] 45.182.22.189 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
description:
Jan 28 21:56:04 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.224.121.102
description:
[2025-01-28 21:56:13 +0100] info [webmaild] 181.224.121.102 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.106.242.132
description:
[2025-01-28 21:56:19 +0100] info [webmaild] 79.106.242.132 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 21:55:50 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
description:
2025-01-28 21:56:06 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:42974: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
description:
Jan 28 21:55:49 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
description:
2025-01-28 21:55:51 dovecot_plain authenticator failed for ([103.90.97.98]) [103.90.97.98]:43312: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 28 21:56:49 ait sshd[3932262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 28 21:56:49 ait sshd[3932262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.163.156
description:
[2025-01-28 21:57:40 +0100] info [webmaild] 45.185.163.156 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
description:
Jan 28 21:57:56 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
description:
2025-01-28 21:58:16 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:50080: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.112.193
description:
2025-01-28 21:58:20 dovecot_plain authenticator failed for 131.108.112.193.pontonetassai.com.br [131.108.112.193]:54323: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.34.84
description:
Jan 28 21:58:27 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.112.193
description:
Jan 28 21:58:18 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-01-28 21:57:58 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:39778: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
description:
Jan 28 21:58:14 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 21:58:29 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
description:
2025-01-28 21:58:29 dovecot_plain authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:59066: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS21A00061Y||WPU:ADS21A00061Y||RSV:6.65||T:APACHE||MV:21-58.170.205.31.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.30
description:
[2025-01-28 21:58:08 +0100] info [webmaild] 213.230.93.30 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.140.122
description:
[2025-01-28 21:59:34 +0100] info [webmaild] 157.100.140.122 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.55.155
description:
47.128.55.155 - - [28/Jan/2025:21:58:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6048520 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C61%2C125%2C205%2C30&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.55.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.223.234.176
description:
[2025-01-28 21:58:49 +0100] info [webmaild] 181.223.234.176 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 118.179.25.54
description:
[2025-01-28 21:58:56 +0100] info [webmaild] 118.179.25.54 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 22:00:01 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 82.86.108.23
description:
[2025-01-28 22:00:05 +0100] info [webmaild] 82.86.108.23 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Jan 28 22:00:28 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-01-28 22:00:30 dovecot_plain authenticator failed for (hideencers) [102.53.15.180]:48376: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
description:
Jan 28 22:00:38 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
description:
2025-01-28 22:00:40 dovecot_plain authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:43044: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-28 22:00:53 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:50370: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.68.12.96
description:
Jan 28 22:01:05 ait sshd[3934667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.68.12.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Jan 28 22:01:08 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-01-28 22:01:10 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:51524: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-28 22:01:12 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:21490: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.76.89.102
description:
[2025-01-28 22:00:42 +0100] info [webmaild] 201.76.89.102 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 28 22:00:55 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.148.249
description:
Jan 28 22:01:08 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.148.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 28 22:01:10 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-28 22:00:57 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:48752: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.68.12.96
description:
Jan 28 22:01:05 ait sshd[3934667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.68.12.96


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Jan 28 22:00:58 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-01-28 22:01:00 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:48094: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.68.12.96
description:
[2025-01-28 22:01:05 +0100] info [whostmgrd] 77.68.12.96 - iric.usadministratorindex.php) "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.148.249
description:
2025-01-28 22:01:10 dovecot_login authenticator failed for ([120.71.148.249]) [120.71.148.249]:37562: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 28 22:00:51 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.209.130.210
description:
Jan 28 22:01:45 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.209.130.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.69
description:
[2025-01-28 22:02:04 +0100] info [webmaild] 213.230.87.69 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.130.210
description:
2025-01-28 22:01:47 dovecot_login authenticator failed for 95.209.130.210.bredband.tre.se [95.209.130.210]:39798: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.148.202
description:
[2025-01-28 22:02:10 +0100] info [webmaild] 177.37.148.202 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.209.204
description:
[2025-01-28 22:04:06 +0100] info [webmaild] 168.195.209.204 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.61.174.8
description:
[2025-01-28 22:04:36 +0100] info [webmaild] 186.61.174.8 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.116.222.144
description:
[2025-01-28 22:05:16 +0100] info [webmaild] 176.116.222.144 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-01-28 22:05:48 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:57453: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
description:
2025-01-28 22:06:13 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:52684: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 28 22:05:53 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
description:
Jan 28 22:06:07 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
description:
Jan 28 22:06:11 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
description:
2025-01-28 22:06:09 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:35650: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Jan 28 22:05:46 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-01-28 22:05:55 dovecot_plain authenticator failed for ([112.194.143.206]) [112.194.143.206]:47590: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Jan 28 22:06:04 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
description:
2025-01-28 22:06:06 dovecot_plain authenticator failed for ([110.189.153.136]) [110.189.153.136]:59377: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.33.44.12
description:
Jan 28 22:05:56 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.33.44.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.33.44.12
description:
2025-01-28 22:05:58 dovecot_plain authenticator failed for ([209.33.44.12]) [209.33.44.12]:38459: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.111.225.1
description:
[2025-01-28 22:07:24 +0100] info [webmaild] 103.111.225.1 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 28 22:06:58 ait sshd[3937330]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 28 22:06:58 ait sshd[3937330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.93.201
description:
[2025-01-28 22:08:24 +0100] info [webmaild] 179.49.93.201 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 22:08:17 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.77.30.70
description:
[2025-01-28 22:08:04 +0100] info [webmaild] 196.77.30.70 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 22:08:39 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.70
description:
2025-01-28 22:08:46 dovecot_plain authenticator failed for ([61.185.226.70]) [61.185.226.70]:58003: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 28 22:08:58 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-28 22:09:00 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:1589: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.57.215
description:
[2025-01-28 22:09:40 +0100] info [webmaild] 170.231.57.215 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.70
description:
Jan 28 22:08:44 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-28 22:10:15 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:40862: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.52.100.216
description:
[2025-01-28 22:10:21 +0100] info [webmaild] 190.52.100.216 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
description:
Jan 28 22:10:23 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
description:
2025-01-28 22:10:25 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:58003: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 28 22:10:40 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.239.229.199
description:
[2025-01-28 22:10:41 +0100] info [webmaild] 45.239.229.199 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 28 22:10:13 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
description:
2025-01-28 22:11:11 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:42312: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Jan 28 22:11:22 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Jan 28 22:11:37 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-28 22:10:42 dovecot_plain authenticator failed for (redest) [109.160.123.6]:37276: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.76.181.237
description:
Jan 28 22:11:36 ait sshd[3939474]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.76.181.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.181.237
description:
Jan 28 22:11:36 ait sshd[3939474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.181.237


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.18.19.8
description:
[2025-01-28 22:11:37 +0100] info [webmaild] 195.18.19.8 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-01-28 22:11:39 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:17528: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 22:11:34 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-01-28 22:11:24 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:19268: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.155.46
description:
[2025-01-28 22:10:57 +0100] info [webmaild] 45.167.155.46 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
description:
Jan 28 22:11:09 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
description:
2025-01-28 22:11:56 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:51742: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.90.28
description:
Jan 28 22:12:17 ait sshd[3939805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.90.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-01-28 22:12:18 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:39738: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.236.251.66
description:
[2025-01-28 22:12:22 +0100] info [webmaild] 200.236.251.66 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Jan 28 22:11:55 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
description:
Jan 28 22:11:59 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.136.236
description:
[2025-01-28 22:12:41 +0100] info [webmaild] 168.205.136.236 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Jan 28 22:11:54 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
description:
2025-01-28 22:12:01 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:51527: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Jan 28 22:12:16 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-01-28 22:11:57 dovecot_plain authenticator failed for (tracta) [185.168.173.87]:56228: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 216.98.214.68
description:
[2025-01-28 22:12:10 +0100] info [webmaild] 216.98.214.68 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 22:13:07 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
description:
Jan 28 22:14:32 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-01-28 22:14:34 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:57262: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.149.93.199
description:
[2025-01-28 22:13:43 +0100] info [webmaild] 5.149.93.199 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.10.134.147
description:
[2025-01-28 22:13:46 +0100] info [webmaild] 41.10.134.147 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 22:14:07 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.1.10
description:
2025-01-28 22:15:09 dovecot_plain authenticator failed for pool-100-37-1-10.nycmny.fios.verizon.net [100.37.1.10]:54140: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 22:14:41 ait sshd[3940818]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 22:14:41 ait sshd[3940818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 22:14:58 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 100.37.1.10
description:
Jan 28 22:15:07 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 100.37.1.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 159.146.33.114
description:
[2025-01-28 22:15:40 +0100] info [webmaild] 159.146.33.114 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 28 22:16:19 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-28 22:16:21 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:65170: 535 Incorrect authentication data (set_id=mappiah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-16.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 22:15:48 ait sshd[3941317]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 22:15:48 ait sshd[3941317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS23B00195Y||WPU:ADS23B00195Y||RSV:6.65||T:APACHE||MV:22-16.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Jan 28 22:16:06 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-01-28 22:16:08 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:43419: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.84.70.89
description:
[2025-01-28 22:16:21 +0100] info [webmaild] 185.84.70.89 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 28 22:16:28 ait sshd[3941682]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
description:
Jan 28 22:17:39 ait auth[3928677]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-28 22:17:02 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (miapoly) [89.153.62.100]:47504: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


