# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
description:
2025-01-25 20:02:58 dovecot_plain authenticator failed for ([113.59.34.8]) [113.59.34.5]:55554: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Jan 25 20:03:07 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-01-25 20:03:09 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:50649: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Jan 25 20:03:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-25 20:03:29 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (adbraceng) [217.215.254.115]:58916: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 20:03:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Jan 25 20:03:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-01-25 20:03:39 dovecot_plain authenticator failed for (emialotia) [89.109.233.181]:42055: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.33.74.81
description:
Jan 25 20:03:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.33.74.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.33.74.81
description:
2025-01-25 20:03:26 dovecot_plain authenticator failed for (hospitalperpetuosocorro.static.gvt.net.br) [191.33.74.81]:46031: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Jan 25 20:04:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-01-25 20:04:26 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:34434: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.215.212.160
description:
Jan 25 20:04:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.215.212.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.215.212.160
description:
2025-01-25 20:04:44 dovecot_plain authenticator failed for 218-215-212-160.sta.wbroadband.net.au [218.215.212.160]:45087: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.33.235
description:
Jan 25 20:05:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.33.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
description:
Jan 25 20:05:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.33.235
description:
2025-01-25 20:05:33 dovecot_plain authenticator failed for ([70.89.33.235]) [70.89.33.235]:33148: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
description:
2025-01-25 20:05:34 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:46330: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Jan 25 20:05:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-01-25 20:05:42 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:40246: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
description:
Jan 25 20:06:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
description:
Jan 25 20:06:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
description:
2025-01-25 20:06:44 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:41122: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-25 20:06:54 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:47326: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Jan 25 20:06:59 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.247.22.135
description:
2025-01-25 20:07:00 dovecot_plain authenticator failed for 135.22.247.35.bc.googleusercontent.com (7.26.82.34.bc.googleusercontent.com) [35.247.22.135]:35941: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.62.171
description:
2025-01-25 20:07:06 dovecot_plain authenticator failed for ([103.147.62.171]) [103.147.62.171]:45076: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
description:
2025-01-25 20:06:35 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:49594: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 25 20:06:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.247.22.135
description:
Jan 25 20:06:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.247.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 20:07:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-01-25 20:07:01 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:51956: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.62.171
description:
Jan 25 20:07:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.62.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-25 20:07:12 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:40330: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.162.165.238
description:
2025-01-25 20:07:36 dovecot_plain authenticator failed for (ineping) [130.162.165.238]:40912: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.148.85.53
description:
2025-01-25 20:08:00 dovecot_plain authenticator failed for ([157.148.85.53]) [157.148.85.53]:41975: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Jan 25 20:07:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 25 20:07:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 20:07:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-25 20:07:15 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:54217: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-01-25 20:07:17 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:53412: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-25 20:07:27 dovecot_plain authenticator failed for ([93.182.160.222]) [93.182.160.222]:41852: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.162.165.238
description:
Jan 25 20:07:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.162.165.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.102
description:
Jan 25 20:08:08 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-25 20:07:27 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:37154: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.148.85.53
description:
Jan 25 20:07:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.148.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 25 20:07:10 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 25 20:07:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
description:
Jan 25 20:07:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
description:
2025-01-25 20:07:18 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:49423: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 25 20:07:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 25 20:08:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-01-25 20:08:48 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:43220: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 25 20:08:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Jan 25 20:08:41 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-01-25 20:08:43 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:43035: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.127.242
domain: lms.aitsmartschool.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Jan 25 20:08:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
description:
Jan 25 20:08:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Jan 25 20:08:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 25 20:09:01 ait sshd[1738304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 25 20:08:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-25 20:08:11 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:42817: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-25 20:08:27 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:53864: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Jan 25 20:08:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 25 20:09:01 ait sshd[1738304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.102
description:
2025-01-25 20:08:10 dovecot_plain authenticator failed for ([102.69.163.102]) [102.69.163.102]:54481: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.42.148
description:
47.128.42.148 - - [25/Jan/2025:20:08:20 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15241307 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?duration=short%2Cmedium%2Clong&filter_course-language=99&filtering=1&level=intermediate%2Cbeginner%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.42.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
description:
2025-01-25 20:08:58 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:49364: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-01-25 20:08:59 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:33110: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-25 20:08:48 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:44238: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-01-25 20:08:54 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:54902: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-01-25 20:09:35 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:41258: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-25 20:10:00 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:56458: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
description:
Jan 25 20:09:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.221.25.242
description:
2025-01-25 20:09:56 dovecot_plain authenticator failed for (Marwa.2feok15dbpkuzkqwbsoic1amka.madx.internal.cloudapp.net) [68.221.25.242]:55763: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 25 20:09:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.68.89
description:
Jan 25 20:10:07 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.148
description:
2025-01-25 20:09:27 dovecot_plain authenticator failed for ([216.126.65.148]) [216.126.65.148]:41846: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Jan 25 20:09:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
description:
2025-01-25 20:09:38 dovecot_plain authenticator failed for ([125.35.109.214]) [125.35.109.214]:40553: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 20:09:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.68.89
description:
2025-01-25 20:10:09 dovecot_plain authenticator failed for (abts-kk-static-89.68.166.122.airtelbroadband.in) [122.166.68.89]:50863: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.126.65.148
description:
Jan 25 20:09:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.126.65.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 25 20:09:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-25 20:09:46 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:54468: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.221.25.242
description:
Jan 25 20:09:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.221.25.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 20:09:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.104.247
description:
[2025-01-25 20:10:27 +0100] info [webmaild] 157.100.104.247 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.209.100.133
description:
[2025-01-25 20:10:44 +0100] info [webmaild] 181.209.100.133 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.143.248.75
description:
[2025-01-25 20:10:48 +0100] info [webmaild] 181.143.248.75 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 68.221.25.242
description:
[2025-01-25 20:10:17 +0100] info [webmaild] 68.221.25.242 - abs20b00128y@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.224.106.47
description:
Jan 25 20:10:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.224.106.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.58.39.79
description:
[2025-01-25 20:10:59 +0100] info [webmaild] 181.58.39.79 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.224.106.47
description:
2025-01-25 20:10:30 dovecot_plain authenticator failed for ([117.72.66.209]) [27.224.106.47]:15482: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.87.117.146
description:
[2025-01-25 20:10:50 +0100] info [webmaild] 187.87.117.146 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.18.18.228
description:
[2025-01-25 20:10:52 +0100] info [webmaild] 195.18.18.228 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.107.204.19
description:
[2025-01-25 20:11:03 +0100] info [webmaild] 200.107.204.19 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.24.150.246
description:
[2025-01-25 20:11:09 +0100] info [webmaild] 200.24.150.246 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Jan 25 20:10:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.41.99
description:
[2025-01-25 20:10:33 +0100] info [webmaild] 37.238.41.99 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.65.225
description:
[2025-01-25 20:10:35 +0100] info [webmaild] 168.232.65.225 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.16.49.202
description:
[2025-01-25 20:10:46 +0100] info [webmaild] 188.16.49.202 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.252.194.117
description:
[2025-01-25 20:11:05 +0100] info [webmaild] 151.252.194.117 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.252.6.74
description:
[2025-01-25 20:10:54 +0100] info [webmaild] 179.252.6.74 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.170.10.159
description:
[2025-01-25 20:11:07 +0100] info [webmaild] 93.170.10.159 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-01-25 20:10:22 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:50757: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.16.69.33
description:
[2025-01-25 20:10:37 +0100] info [webmaild] 190.16.69.33 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.10.229
description:
[2025-01-25 20:10:40 +0100] info [webmaild] 131.196.10.229 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-01-25 20:10:40 dovecot_login authenticator failed for ([193.158.248.248]) [193.158.248.248]:59958: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.165.113.99
description:
[2025-01-25 20:10:25 +0100] info [webmaild] 165.165.113.99 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.240.17.192
description:
[2025-01-25 20:10:30 +0100] info [webmaild] 185.240.17.192 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.118.53
description:
Jan 25 20:10:49 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.118.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
description:
2025-01-25 20:10:51 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:60852: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.225.162
description:
[2025-01-25 20:10:57 +0100] info [webmaild] 186.225.225.162 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Jan 25 20:10:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.168.111
description:
[2025-01-25 20:11:48 +0100] info [webmaild] 177.22.168.111 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.166.215
description:
[2025-01-25 20:11:51 +0100] info [webmaild] 181.115.166.215 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 20:11:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.164.193.186
description:
2025-01-25 20:12:03 dovecot_plain authenticator failed for ([123.164.193.186]) [123.164.193.186]:46225: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.247.73.89
description:
[2025-01-25 20:11:28 +0100] info [webmaild] 154.247.73.89 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.38.41.216
description:
[2025-01-25 20:11:31 +0100] info [webmaild] 189.38.41.216 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 25 20:11:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.194.42
description:
[2025-01-25 20:11:43 +0100] info [webmaild] 198.163.194.42 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.118.174
description:
[2025-01-25 20:11:45 +0100] info [webmaild] 213.230.118.174 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.223.120.79
description:
[2025-01-25 20:11:21 +0100] info [webmaild] 186.223.120.79 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.60
description:
[2025-01-25 20:11:53 +0100] info [webmaild] 84.54.70.60 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.198.75
description:
2025-01-25 20:11:52 dovecot_plain authenticator failed for ([185.221.198.75]) [185.221.198.75]:49044: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-25 20:11:53 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:48016: 535 Incorrect authentication data (set_id=akoto)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.135.184
description:
[2025-01-25 20:12:03 +0100] info [webmaild] 103.135.135.184 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.103.158
description:
[2025-01-25 20:11:39 +0100] info [webmaild] 45.238.103.158 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.159.114
description:
Jan 25 20:11:41 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.159.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.221.198.75
description:
Jan 25 20:11:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.221.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.135.35.113
description:
[2025-01-25 20:11:58 +0100] info [webmaild] 190.135.35.113 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.37.72.213
description:
[2025-01-25 20:12:06 +0100] info [webmaild] 179.37.72.213 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 25 20:11:51 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.164.193.186
description:
Jan 25 20:12:01 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.164.193.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 113.192.47.142
description:
[2025-01-25 20:11:15 +0100] info [webmaild] 113.192.47.142 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.187.151.197
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:20-11.170.187.151.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.23.128
description:
[2025-01-25 20:11:24 +0100] info [webmaild] 177.185.23.128 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-25 20:11:38 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:38980: 535 Incorrect authentication data (set_id=akoto@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.159.114
description:
2025-01-25 20:11:43 dovecot_plain authenticator failed for p88115-obmd01.osaka.ocn.ne.jp [180.7.159.114]:51999: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-25 20:11:45 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:53642: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.165.33
description:
[2025-01-25 20:11:12 +0100] info [webmaild] 197.185.165.33 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.153.155.218
description:
[2025-01-25 20:11:34 +0100] info [webmaild] 103.153.155.218 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.217.193.202
description:
[2025-01-25 20:12:08 +0100] info [webmaild] 85.217.193.202 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.57.79.80
description:
[2025-01-25 20:11:19 +0100] info [webmaild] 187.57.79.80 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 25 20:11:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
description:
2025-01-25 20:11:55 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:38191: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.33.206.49
description:
[2025-01-25 20:11:56 +0100] info [webmaild] 187.33.206.49 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.224.175.240
description:
[2025-01-25 20:12:09 +0100] info [webmaild] 181.224.175.240 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.188.222.251
description:
[2025-01-25 20:11:17 +0100] info [webmaild] 191.188.222.251 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.146.168.55
description:
[2025-01-25 20:11:36 +0100] info [webmaild] 197.146.168.55 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.12.114.108
description:
[2025-01-25 20:11:41 +0100] info [webmaild] 190.12.114.108 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.4.153.7
description:
Jan 25 20:11:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.4.153.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.186.115.194
description:
[2025-01-25 20:12:00 +0100] info [webmaild] 103.186.115.194 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 25 20:12:55 ait sshd[1740393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.181.42.187
description:
[2025-01-25 20:12:56 +0100] info [webmaild] 168.181.42.187 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.72.203
description:
[2025-01-25 20:13:04 +0100] info [webmaild] 213.230.72.203 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.250.19
description:
[2025-01-25 20:12:12 +0100] info [webmaild] 37.237.250.19 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Jan 25 20:12:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.124.244.197
description:
[2025-01-25 20:12:14 +0100] info [webmaild] 190.124.244.197 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-01-25 20:12:34 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:33383: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.184.173.86
description:
[2025-01-25 20:13:01 +0100] info [webmaild] 103.184.173.86 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.250.100.72
description:
[2025-01-25 20:13:06 +0100] info [webmaild] 41.250.100.72 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-01-25 20:12:17 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:49581: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 141.138.99.98
description:
[2025-01-25 20:12:29 +0100] info [webmaild] 141.138.99.98 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.63.138.27
description:
[2025-01-25 20:12:51 +0100] info [webmaild] 119.63.138.27 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.22.167.180
description:
[2025-01-25 20:12:53 +0100] info [webmaild] 38.22.167.180 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.125.178.21
description:
[2025-01-25 20:12:19 +0100] info [webmaild] 103.125.178.21 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.14.175.57
description:
[2025-01-25 20:12:33 +0100] info [webmaild] 181.14.175.57 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.154.16.172
description:
[2025-01-25 20:12:49 +0100] info [webmaild] 85.154.16.172 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.3.213
description:
[2025-01-25 20:12:55 +0100] info [webmaild] 138.97.3.213 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.22.238.244
description:
[2025-01-25 20:13:01 +0100] info [webmaild] 186.22.238.244 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.75.46
description:
[2025-01-25 20:13:03 +0100] info [webmaild] 45.182.75.46 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.35.90
description:
[2025-01-25 20:12:31 +0100] info [webmaild] 45.229.35.90 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.242.13.171
description:
[2025-01-25 20:12:42 +0100] info [webmaild] 46.242.13.171 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.7.188.20
description:
[2025-01-25 20:13:03 +0100] info [webmaild] 190.7.188.20 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.233.124
description:
[2025-01-25 20:12:24 +0100] info [webmaild] 103.135.233.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Jan 25 20:12:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.174.126
description:
[2025-01-25 20:12:28 +0100] info [webmaild] 168.195.174.126 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Jan 25 20:12:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.75.144.67
description:
[2025-01-25 20:12:35 +0100] info [webmaild] 201.75.144.67 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.196.140.141
description:
[2025-01-25 20:12:37 +0100] info [webmaild] 200.196.140.141 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 20:12:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.22.47
description:
[2025-01-25 20:12:16 +0100] info [webmaild] 177.185.22.47 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.47.43
description:
Jan 25 20:12:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.47.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.47.43
description:
2025-01-25 20:12:25 dovecot_plain authenticator failed for ([117.192.47.43]) [117.192.47.43]:39413: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.4.175
description:
[2025-01-25 20:12:58 +0100] info [webmaild] 131.0.4.175 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.110.189.113
description:
[2025-01-25 20:12:59 +0100] info [webmaild] 83.110.189.113 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.126.162.62
description:
[2025-01-25 20:13:06 +0100] info [webmaild] 196.126.162.62 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.194.104.203
description:
[2025-01-25 20:13:09 +0100] info [webmaild] 185.194.104.203 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.17.141.116
description:
[2025-01-25 20:12:40 +0100] info [webmaild] 191.17.141.116 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.70.40
description:
[2025-01-25 20:12:43 +0100] info [webmaild] 45.179.70.40 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.101.144.124
description:
[2025-01-25 20:12:55 +0100] info [webmaild] 187.101.144.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.88.169.86
description:
[2025-01-25 20:12:57 +0100] info [webmaild] 201.88.169.86 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-01-25 20:12:46 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:37620: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.237.111
description:
[2025-01-25 20:12:51 +0100] info [webmaild] 37.40.237.111 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 25 20:12:55 ait sshd[1740393]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.137.242
description:
[2025-01-25 20:12:31 +0100] info [webmaild] 179.125.137.242 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.96.73.149
description:
[2025-01-25 20:12:46 +0100] info [webmaild] 177.96.73.149 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.210.107.82
description:
[2025-01-25 20:12:47 +0100] info [webmaild] 196.210.107.82 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.38.10.142
description:
[2025-01-25 20:14:03 +0100] info [webmaild] 92.38.10.142 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.252.24.18
description:
[2025-01-25 20:13:14 +0100] info [webmaild] 109.252.24.18 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.31.76
description:
Jan 25 20:13:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.31.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.41.121
description:
[2025-01-25 20:13:21 +0100] info [webmaild] 91.106.41.121 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.53.25.175
description:
[2025-01-25 20:13:26 +0100] info [webmaild] 200.53.25.175 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.246.30.55
description:
2025-01-25 20:13:48 dovecot_plain authenticator failed for ([162.246.30.55]) [162.246.30.55]:58920: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
description:
Jan 25 20:13:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.81.105.152
description:
[2025-01-25 20:14:00 +0100] info [webmaild] 103.81.105.152 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.251.229.177
description:
[2025-01-25 20:14:05 +0100] info [webmaild] 201.251.229.177 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.129.67
description:
[2025-01-25 20:14:08 +0100] info [webmaild] 168.196.129.67 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.6.100.148
description:
[2025-01-25 20:13:11 +0100] info [webmaild] 177.6.100.148 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.23.194.197
description:
[2025-01-25 20:13:16 +0100] info [webmaild] 187.23.194.197 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.26.99.149
description:
[2025-01-25 20:13:20 +0100] info [webmaild] 186.26.99.149 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.197.15.15
description:
[2025-01-25 20:13:38 +0100] info [webmaild] 181.197.15.15 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.125.89.2
description:
[2025-01-25 20:14:01 +0100] info [webmaild] 154.125.89.2 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
description:
2025-01-25 20:14:05 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:43648: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.69.10
description:
[2025-01-25 20:13:10 +0100] info [webmaild] 37.236.69.10 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.71.208
description:
[2025-01-25 20:13:17 +0100] info [webmaild] 170.81.71.208 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.244.154.102
description:
[2025-01-25 20:13:23 +0100] info [webmaild] 185.244.154.102 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.31.76
description:
2025-01-25 20:13:22 dovecot_plain authenticator failed for ([45.83.31.76]) [45.83.31.76]:58653: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.39.134.59
description:
[2025-01-25 20:13:49 +0100] info [webmaild] 186.39.134.59 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
description:
2025-01-25 20:13:56 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:49910: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.51.119
description:
[2025-01-25 20:13:13 +0100] info [webmaild] 170.233.51.119 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.69.230.214
description:
[2025-01-25 20:13:18 +0100] info [webmaild] 195.69.230.214 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.235.21.36
description:
[2025-01-25 20:13:58 +0100] info [webmaild] 45.235.21.36 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.103.66
description:
[2025-01-25 20:14:07 +0100] info [webmaild] 45.230.103.66 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.105.223.161
description:
[2025-01-25 20:13:19 +0100] info [webmaild] 176.105.223.161 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.147.182
description:
[2025-01-25 20:13:31 +0100] info [webmaild] 45.165.147.182 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.246.30.55
description:
Jan 25 20:13:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.246.30.55 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.177.2.247
description:
[2025-01-25 20:14:02 +0100] info [webmaild] 201.177.2.247 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 129.122.152.104
description:
[2025-01-25 20:14:09 +0100] info [webmaild] 129.122.152.104 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.106.126.122
description:
[2025-01-25 20:13:22 +0100] info [webmaild] 79.106.126.122 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.210.146.219
description:
[2025-01-25 20:13:28 +0100] info [webmaild] 186.210.146.219 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.223.203.158
description:
[2025-01-25 20:13:33 +0100] info [webmaild] 179.223.203.158 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.129.196.86
description:
[2025-01-25 20:13:55 +0100] info [webmaild] 190.129.196.86 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.58.118
description:
[2025-01-25 20:13:57 +0100] info [webmaild] 128.201.58.118 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
description:
Jan 25 20:14:03 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.215.220.67
description:
[2025-01-25 20:13:13 +0100] info [webmaild] 156.215.220.67 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.93.189
description:
[2025-01-25 20:13:16 +0100] info [webmaild] 177.72.93.189 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.63.228.23
description:
[2025-01-25 20:14:51 +0100] info [webmaild] 187.63.228.23 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.205.9
description:
[2025-01-25 20:15:06 +0100] info [webmaild] 177.72.205.9 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.50.66.180
description:
[2025-01-25 20:14:15 +0100] info [webmaild] 182.50.66.180 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Jan 25 20:14:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.84.42.230
description:
[2025-01-25 20:14:40 +0100] info [webmaild] 138.84.42.230 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.76.2.80
description:
[2025-01-25 20:14:43 +0100] info [webmaild] 201.76.2.80 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.220.180.54
description:
[2025-01-25 20:15:03 +0100] info [webmaild] 177.220.180.54 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.16.72.53
description:
[2025-01-25 20:14:12 +0100] info [webmaild] 62.16.72.53 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.202.60
description:
[2025-01-25 20:14:19 +0100] info [webmaild] 176.29.202.60 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Jan 25 20:14:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.104.168.138
description:
[2025-01-25 20:14:41 +0100] info [webmaild] 95.104.168.138 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.110.109.6
description:
[2025-01-25 20:14:48 +0100] info [webmaild] 187.110.109.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.166.160.90
description:
[2025-01-25 20:14:54 +0100] info [webmaild] 190.166.160.90 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-25 20:14:56 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:56698: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.72.155.143
description:
[2025-01-25 20:14:59 +0100] info [webmaild] 94.72.155.143 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.146.233
description:
[2025-01-25 20:14:17 +0100] info [webmaild] 138.255.146.233 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.220.105.6
description:
[2025-01-25 20:14:47 +0100] info [webmaild] 102.220.105.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.44.122
description:
2025-01-25 20:14:48 dovecot_plain authenticator failed for p384123-obmd01.tokyo.ocn.ne.jp [60.45.44.122]:36916: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.110.115.89
description:
[2025-01-25 20:15:06 +0100] info [webmaild] 84.110.115.89 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
description:
Jan 25 20:14:14 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.94.196
description:
[2025-01-25 20:14:54 +0100] info [webmaild] 132.255.94.196 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.189.95.160
description:
[2025-01-25 20:15:02 +0100] info [webmaild] 186.189.95.160 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.196.72.230
description:
[2025-01-25 20:15:09 +0100] info [webmaild] 181.196.72.230 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.4.210.184
description:
[2025-01-25 20:14:27 +0100] info [webmaild] 189.4.210.184 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.58.116
description:
[2025-01-25 20:14:37 +0100] info [webmaild] 170.246.58.116 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.10.99.144
description:
[2025-01-25 20:14:26 +0100] info [webmaild] 187.10.99.144 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 134.0.207.94
description:
[2025-01-25 20:14:27 +0100] info [webmaild] 134.0.207.94 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.113.235
description:
[2025-01-25 20:14:46 +0100] info [webmaild] 45.183.113.235 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.244.212.243
description:
[2025-01-25 20:14:57 +0100] info [webmaild] 197.244.212.243 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.175.241.213
description:
[2025-01-25 20:14:30 +0100] info [webmaild] 179.175.241.213 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.249.140
description:
[2025-01-25 20:14:34 +0100] info [webmaild] 131.221.249.140 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
description:
2025-01-25 20:14:16 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:59024: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.248.230
description:
[2025-01-25 20:14:23 +0100] info [webmaild] 138.0.248.230 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.171.206.50
description:
[2025-01-25 20:14:23 +0100] info [webmaild] 83.171.206.50 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-01-25 20:14:36 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:34772: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.151.140
description:
[2025-01-25 20:14:44 +0100] info [webmaild] 187.62.151.140 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.220.90.0
description:
[2025-01-25 20:14:52 +0100] info [webmaild] 83.220.90.0 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 20:14:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.199.172
description:
[2025-01-25 20:14:12 +0100] info [webmaild] 186.249.199.172 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-01-25 20:14:20 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:60796: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.44.122
description:
Jan 25 20:14:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.44.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.71.226.77
description:
[2025-01-25 20:14:53 +0100] info [webmaild] 186.71.226.77 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.90.253.145
description:
[2025-01-25 20:14:16 +0100] info [webmaild] 178.90.253.145 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Jan 25 20:14:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.149.54
description:
[2025-01-25 20:14:34 +0100] info [webmaild] 177.67.149.54 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.193.92.192
description:
[2025-01-25 20:14:37 +0100] info [webmaild] 191.193.92.192 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.142.164
description:
[2025-01-25 20:15:04 +0100] info [webmaild] 168.0.142.164 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.214.3.77
description:
[2025-01-25 20:15:05 +0100] info [webmaild] 189.214.3.77 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.140.112.49
description:
[2025-01-25 20:14:11 +0100] info [webmaild] 190.140.112.49 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.0.90.31
description:
[2025-01-25 20:14:32 +0100] info [webmaild] 152.0.90.31 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.192.179
description:
[2025-01-25 20:14:45 +0100] info [webmaild] 45.188.192.179 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.217.47.45
description:
[2025-01-25 20:14:19 +0100] info [webmaild] 181.217.47.45 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 25 20:14:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.35.183
description:
[2025-01-25 20:14:56 +0100] info [webmaild] 45.4.35.183 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.89.121.2
description:
[2025-01-25 20:15:09 +0100] info [webmaild] 197.89.121.2 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.51.242
description:
[2025-01-25 20:14:22 +0100] info [webmaild] 45.238.51.242 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-01-25 20:14:22 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:52930: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.110.208.57
description:
[2025-01-25 20:14:25 +0100] info [webmaild] 187.110.208.57 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.96.58
description:
[2025-01-25 20:14:39 +0100] info [webmaild] 177.91.96.58 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.54.163.99
description:
[2025-01-25 20:14:42 +0100] info [webmaild] 95.54.163.99 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.153.238.182
description:
[2025-01-25 20:14:50 +0100] info [webmaild] 85.153.238.182 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.214.64.46
description:
[2025-01-25 20:14:58 +0100] info [webmaild] 37.214.64.46 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.117.16
description:
[2025-01-25 20:15:00 +0100] info [webmaild] 177.93.117.16 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.128.164.121
description:
[2025-01-25 20:14:21 +0100] info [webmaild] 94.128.164.121 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.41.42.29
description:
[2025-01-25 20:14:49 +0100] info [webmaild] 38.41.42.29 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.203.141.23
description:
[2025-01-25 20:14:51 +0100] info [webmaild] 197.203.141.23 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.177.105.135
description:
[2025-01-25 20:15:13 +0100] info [webmaild] 179.177.105.135 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.98.152.214
description:
[2025-01-25 20:15:28 +0100] info [webmaild] 41.98.152.214 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.203.52.23
description:
[2025-01-25 20:15:36 +0100] info [webmaild] 185.203.52.23 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.27.25
description:
[2025-01-25 20:15:54 +0100] info [webmaild] 170.239.27.25 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.199.176.101
description:
[2025-01-25 20:15:55 +0100] info [webmaild] 103.199.176.101 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.5.36.107
description:
[2025-01-25 20:16:07 +0100] info [webmaild] 190.5.36.107 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.53.13.105
description:
[2025-01-25 20:15:15 +0100] info [webmaild] 181.53.13.105 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-01-25 20:15:19 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:55626: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 25 20:15:22 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.122.15
description:
[2025-01-25 20:15:24 +0100] info [webmaild] 177.128.122.15 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
description:
2025-01-25 20:15:29 dovecot_plain authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:50467: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.107.138
description:
[2025-01-25 20:15:40 +0100] info [webmaild] 45.181.107.138 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.61.169
description:
[2025-01-25 20:15:18 +0100] info [webmaild] 177.84.61.169 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.121.39.1
description:
[2025-01-25 20:15:22 +0100] info [webmaild] 41.121.39.1 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.35.64.37
description:
[2025-01-25 20:15:27 +0100] info [webmaild] 177.35.64.37 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.222.239.55
description:
[2025-01-25 20:16:02 +0100] info [webmaild] 185.222.239.55 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.128.161.124
description:
[2025-01-25 20:16:05 +0100] info [webmaild] 94.128.161.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.94.1.182
description:
[2025-01-25 20:16:09 +0100] info [webmaild] 187.94.1.182 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.71
description:
[2025-01-25 20:15:17 +0100] info [webmaild] 84.54.72.71 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 72.27.47.235
description:
[2025-01-25 20:15:36 +0100] info [webmaild] 72.27.47.235 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.92.62.250
description:
[2025-01-25 20:15:45 +0100] info [webmaild] 190.92.62.250 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.113
description:
[2025-01-25 20:15:12 +0100] info [webmaild] 84.54.70.113 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.33.79.96
description:
[2025-01-25 20:15:29 +0100] info [webmaild] 201.33.79.96 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.82
description:
Jan 25 20:15:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.77.47.24
description:
[2025-01-25 20:15:45 +0100] info [webmaild] 190.77.47.24 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.29.234.74
description:
[2025-01-25 20:15:49 +0100] info [webmaild] 197.29.234.74 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.186.156.0
description:
[2025-01-25 20:15:11 +0100] info [webmaild] 213.186.156.0 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.115.7.104
description:
[2025-01-25 20:15:27 +0100] info [webmaild] 212.115.7.104 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.247.80.223
description:
[2025-01-25 20:15:40 +0100] info [webmaild] 186.247.80.223 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.237.157
description:
[2025-01-25 20:15:22 +0100] info [webmaild] 143.208.237.157 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.166
description:
Jan 25 20:15:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.210.14.97
description:
[2025-01-25 20:15:25 +0100] info [webmaild] 102.210.14.97 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.136.182
description:
[2025-01-25 20:15:30 +0100] info [webmaild] 45.177.136.182 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.82
description:
2025-01-25 20:15:39 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.82]:36149: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.178.152.214
description:
[2025-01-25 20:16:00 +0100] info [webmaild] 45.178.152.214 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.92.158.201
description:
[2025-01-25 20:15:14 +0100] info [webmaild] 109.92.158.201 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.157.23
description:
[2025-01-25 20:15:38 +0100] info [webmaild] 45.65.157.23 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.97.116.204
description:
[2025-01-25 20:15:43 +0100] info [webmaild] 201.97.116.204 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.166
description:
2025-01-25 20:15:48 dovecot_plain authenticator failed for 83-233-71-166.cust.bredband2.com [83.233.71.166]:38320: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.116.217
description:
[2025-01-25 20:15:43 +0100] info [webmaild] 179.48.116.217 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.106.206
description:
[2025-01-25 20:15:47 +0100] info [webmaild] 45.187.106.206 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.5.193.124
description:
[2025-01-25 20:16:05 +0100] info [webmaild] 213.5.193.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.66.135.132
description:
[2025-01-25 20:16:09 +0100] info [webmaild] 105.66.135.132 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-25 20:15:24 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com (unchs) [131.106.85.205]:59138: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Jan 25 20:15:17 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.98.20.29
description:
[2025-01-25 20:15:20 +0100] info [webmaild] 105.98.20.29 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.162.199
description:
[2025-01-25 20:16:04 +0100] info [webmaild] 170.254.162.199 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.233.63
description:
[2025-01-25 20:16:07 +0100] info [webmaild] 177.87.233.63 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.196.163.191
description:
[2025-01-25 20:15:56 +0100] info [webmaild] 217.196.163.191 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.241.247.168
description:
[2025-01-25 20:15:58 +0100] info [webmaild] 154.241.247.168 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.83.61.24
description:
[2025-01-25 20:15:11 +0100] info [webmaild] 177.83.61.24 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.221.220.30
description:
[2025-01-25 20:15:20 +0100] info [webmaild] 102.221.220.30 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.137
description:
Jan 25 20:15:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.141.7
description:
[2025-01-25 20:15:34 +0100] info [webmaild] 37.238.141.7 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.102.255.156
description:
[2025-01-25 20:15:38 +0100] info [webmaild] 187.102.255.156 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.133
description:
2025-01-25 20:16:24 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:33722: 535 Incorrect authentication data (set_id=akoto@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.179.9.208
description:
[2025-01-25 20:16:44 +0100] info [webmaild] 196.179.9.208 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.161.149
description:
[2025-01-25 20:16:52 +0100] info [webmaild] 177.11.161.149 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.144.103.255
description:
[2025-01-25 20:17:03 +0100] info [webmaild] 192.144.103.255 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.106.240.115
description:
[2025-01-25 20:17:07 +0100] info [webmaild] 187.106.240.115 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-01-25 20:16:29 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:58570: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 20:16:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.67.14
description:
2025-01-25 20:16:37 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:40144: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.84.160
description:
[2025-01-25 20:16:42 +0100] info [webmaild] 191.5.84.160 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.213.187.41
description:
Jan 25 20:17:03 ait sshd[1742296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.213.187.41


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.53.215.67
description:
[2025-01-25 20:16:18 +0100] info [webmaild] 177.53.215.67 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.133
description:
Jan 25 20:16:22 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.162.73.92
description:
[2025-01-25 20:16:23 +0100] info [webmaild] 201.162.73.92 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.132.115.237
domain: ait.edu.gh
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/ioxi/retu.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.201.0.243
description:
[2025-01-25 20:16:27 +0100] info [webmaild] 88.201.0.243 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 208.96.134.120
description:
[2025-01-25 20:16:29 +0100] info [webmaild] 208.96.134.120 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.150.50
description:
[2025-01-25 20:16:31 +0100] info [webmaild] 143.208.150.50 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.155.22
description:
[2025-01-25 20:16:49 +0100] info [webmaild] 177.38.155.22 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-01-25 20:17:01 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:51436: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.115.237
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/2024/01/RxR.php||SC:/home/ait02/public_html/wp-content/uploads/2024/01


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.189.26.146
description:
[2025-01-25 20:16:12 +0100] info [webmaild] 181.189.26.146 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.37.90
description:
Jan 25 20:16:14 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.37.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.10.27.190
description:
2025-01-25 20:16:30 dovecot_plain authenticator failed for ([218.10.27.190]) [218.10.27.190]:52239: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 25 20:16:47 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.165.8
description:
[2025-01-25 20:16:56 +0100] info [webmaild] 168.195.165.8 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.159.54.155
description:
[2025-01-25 20:16:33 +0100] info [webmaild] 38.159.54.155 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.25.218
description:
[2025-01-25 20:16:47 +0100] info [webmaild] 138.204.25.218 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.162.196.203
description:
[2025-01-25 20:16:18 +0100] info [webmaild] 179.162.196.203 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.133.65.7
description:
[2025-01-25 20:16:23 +0100] info [webmaild] 41.133.65.7 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.225.96
description:
[2025-01-25 20:16:25 +0100] info [webmaild] 138.59.225.96 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.67.14
description:
Jan 25 20:16:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.67.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 20:16:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.109.99.248
description:
[2025-01-25 20:16:12 +0100] info [webmaild] 179.109.99.248 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
description:
2025-01-25 20:16:16 dovecot_plain authenticator failed for ([185.232.37.90]) [185.232.37.90]:48910: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Jan 25 20:16:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.83.145.193
description:
[2025-01-25 20:16:25 +0100] info [webmaild] 41.83.145.193 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.27.171
description:
[2025-01-25 20:17:09 +0100] info [webmaild] 45.237.27.171 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.10.27.190
description:
Jan 25 20:16:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.10.27.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.10.42
description:
[2025-01-25 20:16:34 +0100] info [webmaild] 177.12.10.42 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.237.119.176
description:
[2025-01-25 20:16:54 +0100] info [webmaild] 212.237.119.176 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 25 20:17:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.173.202
description:
[2025-01-25 20:16:16 +0100] info [webmaild] 45.169.173.202 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.107.240.39
description:
[2025-01-25 20:16:21 +0100] info [webmaild] 95.107.240.39 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-01-25 20:16:20 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:41467: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
description:
2025-01-25 20:16:22 dovecot_plain authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:58172: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 25 20:16:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.178.253.170
description:
[2025-01-25 20:16:45 +0100] info [webmaild] 160.178.253.170 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.106.154.237
description:
Jan 25 20:16:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.106.154.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.105.7.194
description:
[2025-01-25 20:16:50 +0100] info [webmaild] 109.105.7.194 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.213.187.41
description:
Jan 25 20:17:03 ait sshd[1742296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.213.187.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.253.148.210
description:
[2025-01-25 20:16:13 +0100] info [webmaild] 38.253.148.210 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-25 20:16:28 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:57830: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.58.154.59
description:
Jan 25 20:16:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.58.154.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
description:
Jan 25 20:16:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
description:
Jan 25 20:16:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.153.222
description:
[2025-01-25 20:16:20 +0100] info [webmaild] 102.219.153.222 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.224.54
description:
[2025-01-25 20:16:32 +0100] info [webmaild] 138.219.224.54 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.18.247
description:
[2025-01-25 20:16:35 +0100] info [webmaild] 45.180.18.247 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.106.154.237
description:
2025-01-25 20:16:52 dovecot_login authenticator failed for ([149.106.154.237]) [149.106.154.237]:39806: 535 Incorrect authentication data (set_id=akoto@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-25 20:16:49 dovecot_plain authenticator failed for (broadband-37.204-237-3.ip.moscow.rt.ru) [37.204.237.3]:46960: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Jan 25 20:16:59 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.154.59
description:
2025-01-25 20:16:35 dovecot_login authenticator failed for ([101.58.154.59]) [101.58.154.59]:40441: 535 Incorrect authentication data (set_id=akoto)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.106.9
description:
[2025-01-25 20:16:10 +0100] info [webmaild] 169.224.106.9 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.89.157.196
description:
[2025-01-25 20:16:14 +0100] info [webmaild] 185.89.157.196 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.119.7.56
description:
[2025-01-25 20:16:15 +0100] info [webmaild] 46.119.7.56 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.103.86.223
description:
[2025-01-25 20:16:20 +0100] info [webmaild] 191.103.86.223 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Jan 25 20:16:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.11.100.201
description:
[2025-01-25 20:16:28 +0100] info [webmaild] 201.11.100.201 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.65.72.243
description:
[2025-01-25 20:16:29 +0100] info [webmaild] 196.65.72.243 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.169.117
description:
[2025-01-25 20:16:38 +0100] info [webmaild] 177.22.169.117 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.167.17
description:
[2025-01-25 20:16:40 +0100] info [webmaild] 167.250.167.17 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
description:
2025-01-25 20:16:52 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:40312: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-25 20:17:02 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:55700: 535 Incorrect authentication data (set_id=akoto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 20:17:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.43.160.234
description:
[2025-01-25 20:17:14 +0100] info [webmaild] 201.43.160.234 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.38.4.239
description:
[2025-01-25 20:17:21 +0100] info [webmaild] 179.38.4.239 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.51.104.214
description:
2025-01-25 20:17:22 dovecot_plain authenticator failed for (esustiony) [94.51.104.214]:34852: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.175.42
description:
[2025-01-25 20:17:59 +0100] info [webmaild] 103.135.175.42 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 172.98.33.188
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:20-18.172.98.33.188||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.127.182
description:
[2025-01-25 20:17:11 +0100] info [webmaild] 187.108.127.182 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 205.164.162.130
description:
[2025-01-25 20:17:31 +0100] info [webmaild] 205.164.162.130 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.35.129
description:
[2025-01-25 20:17:37 +0100] info [webmaild] 45.224.35.129 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Jan 25 20:17:49 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.98.33.185
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ait02/public_html/wp-content/uploads/index.php


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.251.25
description:
[2025-01-25 20:17:23 +0100] info [webmaild] 179.127.251.25 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.80.143
description:
[2025-01-25 20:17:41 +0100] info [webmaild] 84.54.80.143 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.69.150.239
description:
[2025-01-25 20:17:48 +0100] info [webmaild] 103.69.150.239 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 172.98.33.185
domain: ait.edu.gh
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:6.65||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.191.169
description:
[2025-01-25 20:17:52 +0100] info [webmaild] 168.228.191.169 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.98.33.188
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ait02/public_html/wp-admin/images/index.php


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.187.19.243
description:
[2025-01-25 20:17:18 +0100] info [webmaild] 94.187.19.243 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.115.237
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/Mhbgf.php||SC:/home/ait02/public_html/wp-admin/images/Mhbgf.php


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 82.86.108.130
description:
[2025-01-25 20:17:25 +0100] info [webmaild] 82.86.108.130 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.42.117
description:
[2025-01-25 20:17:43 +0100] info [webmaild] 177.185.42.117 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-01-25 20:17:51 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:33876: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.80
description:
Jan 25 20:18:06 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.80
description:
2025-01-25 20:18:08 dovecot_plain authenticator failed for (80.20.167.124.adsl-pool.sx.cn) [124.167.20.80]:56277: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.19.121
description:
[2025-01-25 20:17:16 +0100] info [webmaild] 179.125.19.121 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.183.15.35
description:
[2025-01-25 20:17:27 +0100] info [webmaild] 185.183.15.35 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.222.122
description:
[2025-01-25 20:17:44 +0100] info [webmaild] 138.59.222.122 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.168.96.205
description:
[2025-01-25 20:17:54 +0100] info [webmaild] 178.168.96.205 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.195.141
description:
[2025-01-25 20:18:01 +0100] info [webmaild] 191.5.195.141 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.59.14.15
description:
[2025-01-25 20:18:03 +0100] info [webmaild] 202.59.14.15 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.51.104.214
description:
Jan 25 20:17:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.51.104.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.98.92
description:
[2025-01-25 20:17:29 +0100] info [webmaild] 45.181.98.92 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 58.65.223.6
description:
[2025-01-25 20:17:39 +0100] info [webmaild] 58.65.223.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.250.57.36
description:
[2025-01-25 20:17:56 +0100] info [webmaild] 94.250.57.36 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-25 20:18:36 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:10982: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-01-25 20:18:40 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:51590: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.224.106.47
description:
Jan 25 20:18:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.224.106.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-01-25 20:19:06 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:46842: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 25 20:18:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
description:
Jan 25 20:18:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
description:
Jan 25 20:18:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-25 20:18:30 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:62722: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 25 20:18:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-01-25 20:18:48 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:44357: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-01-25 20:18:39 dovecot_login authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:50991: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.224.106.47
description:
2025-01-25 20:18:47 dovecot_plain authenticator failed for ([117.72.66.209]) [27.224.106.47]:16963: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.50.164.146
description:
Jan 25 20:18:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.50.164.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 25 20:18:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Jan 25 20:18:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 25 20:18:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-25 20:18:32 dovecot_plain authenticator failed for (trology) [102.53.15.54]:49372: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Jan 25 20:19:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Jan 25 20:18:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
description:
2025-01-25 20:18:37 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:57612: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.98.33.188
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/ait02/public_html/wp-admin/images/about.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
description:
2025-01-25 20:18:13 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:37081: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-25 20:18:25 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:47315: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.50.164.146
description:
2025-01-25 20:18:26 dovecot_plain authenticator failed for static-173-50-164-146.pghkny.fios.verizon.net [173.50.164.146]:64319: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Jan 25 20:18:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
description:
2025-01-25 20:18:43 dovecot_plain authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:52120: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 20:19:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.223.193.232
description:
2025-01-25 20:19:15 dovecot_plain authenticator failed for (88-223-193-232.init.lt) [88.223.193.232]:41519: 535 Incorrect authentication data (set_id=vondee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.98.33.184
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ait02/public_html/wp-admin/images/admin.php


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.115.206
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/ait02/public_html/wp-includes/images/wp-login.php


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.124.91
description:
47.128.124.91 - - [25/Jan/2025:20:19:44 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9549870" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.124.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.223.193.232
description:
Jan 25 20:19:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.223.193.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77350296
name: IM360: Block access to the shell
abuser: 45.132.115.238
domain: ait.edu.gh
description:
IM360: Block access to the shell||MV:/ticket/vendor/htmlawed/htmlawed/gel4y.php||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 172.98.33.184
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:20-19.172.98.33.184||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.132.115.234
domain: ait.edu.gh
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.132.115.236
domain: ait.edu.gh
description:
IM360 WAF: Block interaction with malicious plugin||RSV:6.65||T:APACHE||SC:/home/ait02/public_html/wp-content/plugins/ubh||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.132.115.212
domain: ait.edu.gh
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 20:20:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-25 20:20:38 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:51666: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
description:
Jan 25 20:20:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
description:
2025-01-25 20:20:58 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:42564: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 25 20:20:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
description:
2025-01-25 20:21:46 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:49900: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 25 20:21:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.253.77
description:
2025-01-25 20:21:59 dovecot_plain authenticator failed for (boxbby) [185.254.253.77]:52798: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.184.53.83
description:
2025-01-25 20:21:18 dovecot_plain authenticator failed for (default-rdns.vocus.co.nz) [203.184.53.83]:37339: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.153.28.94
description:
Jan 25 20:21:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.153.28.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
description:
Jan 25 20:21:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
description:
2025-01-25 20:22:06 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:50981: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.184.53.83
description:
Jan 25 20:21:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.184.53.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.253.77
description:
Jan 25 20:21:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.253.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
description:
Jan 25 20:22:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-01-25 20:21:58 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:57926: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Jan 25 20:21:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.153.28.94
description:
2025-01-25 20:21:38 dovecot_plain authenticator failed for ([36.153.28.94]) [36.153.28.94]:53264: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Jan 25 20:21:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-01-25 20:21:50 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:33310: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.229.2
description:
2025-01-25 20:22:30 dovecot_plain authenticator failed for ([27.45.229.2]) [27.45.229.2]:36816: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.232.184
description:
Jan 25 20:22:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.232.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
description:
2025-01-25 20:22:56 dovecot_plain authenticator failed for ([120.234.232.184]) [120.234.232.184]:8416: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 25 20:23:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.137.140
description:
Jan 25 20:22:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.137.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.137.140
description:
2025-01-25 20:22:15 dovecot_plain authenticator failed for ([120.236.137.140]) [120.236.137.140]:47377: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 20:22:17 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.229.2
description:
Jan 25 20:22:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.229.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
description:
Jan 25 20:23:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-25 20:23:06 dovecot_plain authenticator failed for 9498.telnet.bg (roption) [87.254.165.100]:38380: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
description:
2025-01-25 20:23:06 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:57511: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.17.42
description:
Jan 25 20:23:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.17.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.167.25
description:
Jan 25 20:23:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.167.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.167.25
description:
2025-01-25 20:23:50 dovecot_login authenticator failed for ([187.95.167.25]) [187.95.167.25]:58742: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Jan 25 20:24:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-25 20:24:02 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:60664: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.22
description:
2025-01-25 20:24:42 dovecot_plain authenticator failed for ([122.228.225.22]) [122.228.225.22]:59843: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-25 20:24:45 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:35286: 535 Incorrect authentication data (set_id=akoto@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Jan 25 20:24:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Jan 25 20:24:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 25 20:24:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.81.93
description:
2025-01-25 20:24:36 dovecot_plain authenticator failed for ([14.48.81.93]) [14.48.81.93]:41122: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 25 20:24:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.236.174
description:
2025-01-25 20:24:46 dovecot_plain authenticator failed for ([219.129.236.174]) [219.129.236.174]:56169: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-25 20:24:58 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:52673: 535 Incorrect authentication data (set_id=akoto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.65.179.239
description:
Jan 25 20:24:14 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.65.179.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-01-25 20:24:26 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:60026: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-25 20:24:27 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:52049: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.129.236.174
description:
Jan 25 20:24:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.129.236.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.179.239
description:
2025-01-25 20:24:16 dovecot_plain authenticator failed for 82-65-179-239.subs.proxad.net [82.65.179.239]:49114: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.81.93
description:
Jan 25 20:24:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.81.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.22
description:
Jan 25 20:24:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.6
description:
Jan 25 20:25:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-25 20:25:40 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:45282: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.6
description:
2025-01-25 20:25:11 dovecot_plain authenticator failed for ([58.122.255.6]) [58.122.255.6]:34936: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-01-25 20:25:29 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:41848: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
description:
Jan 25 20:25:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 25 20:25:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 25 20:25:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-25 20:25:56 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:33354: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
description:
2025-01-25 20:25:40 dovecot_plain authenticator failed for mail.toptronicsinc.com [218.4.156.254]:42627: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 25 20:25:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-25 20:25:25 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (mentuncon) [81.16.170.117]:39498: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Jan 25 20:25:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.59.245.133
description:
Jan 25 20:26:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.59.245.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-01-25 20:26:59 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:34666: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.4.10.114
description:
Jan 25 20:27:02 ait sshd[1746782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.10.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-25 20:26:50 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:35077: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-25 20:26:55 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:49426: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Jan 25 20:26:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-25 20:26:38 dovecot_plain authenticator failed for ([175.210.74.19]) [175.210.74.19]:50670: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-25 20:26:13 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:33828: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 25 20:26:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 25 20:26:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-25 20:26:41 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:56378: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-25 20:26:50 dovecot_plain authenticator failed for (extrane) [65.20.143.159]:60543: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 25 20:26:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.59.245.133
description:
2025-01-25 20:26:59 dovecot_plain authenticator failed for 133.red-80-59-245.staticip.rima-tde.net [80.59.245.133]:38876: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 25 20:26:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 25 20:26:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.4.10.114
description:
Jan 25 20:27:02 ait sshd[1746782]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.4.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 25 20:26:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.198.59.254
description:
Jan 25 20:27:32 ait sshd[1747004]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.198.59.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.198.59.254
description:
Jan 25 20:27:32 ait sshd[1747004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.198.59.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.96.199.77
description:
2025-01-25 20:27:31 dovecot_plain authenticator failed for ([23.96.199.77]) [23.96.199.77]:54610: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 25 20:27:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-25 20:27:56 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:43937: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.211.130.219
description:
2025-01-25 20:27:14 dovecot_plain authenticator failed for ([185.211.130.219]) [185.211.130.219]:53575: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.167.86.130
description:
Jan 25 20:27:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.167.86.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-25 20:27:29 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:48044: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.8
description:
2025-01-25 20:27:23 dovecot_plain authenticator failed for ([5.30.225.8]) [5.30.225.8]:37996: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-25 20:27:31 dovecot_plain authenticator failed for (overm) [2.110.10.192]:51690: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-25 20:27:35 dovecot_plain authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:65128: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.226.218.185
description:
2025-01-25 20:27:37 dovecot_plain authenticator failed for 168-226-218-185.static.speedy.com.ar [168.226.218.185]:40317: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-25 20:27:54 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:50730: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 25 20:27:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.96.199.77
description:
Jan 25 20:27:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.96.199.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.108.46
description:
Jan 25 20:27:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.108.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Jan 25 20:27:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.108.46
description:
2025-01-25 20:27:40 dovecot_plain authenticator failed for ([212.90.108.46]) [212.90.108.46]:46520: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.174.208
description:
Jan 25 20:27:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.174.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.174.208
description:
2025-01-25 20:27:42 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.174.208]:27050: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.211.130.219
description:
Jan 25 20:27:12 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.211.130.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.167.86.130
description:
2025-01-25 20:27:28 dovecot_plain authenticator failed for (imegoaring) [95.167.86.130]:37390: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 25 20:27:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-25 20:27:30 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:45928: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.226.218.185
description:
Jan 25 20:27:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.226.218.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.8
description:
Jan 25 20:27:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 25 20:27:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 25 20:27:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 20:27:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
description:
Jan 25 20:28:10 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.118.107
description:
Jan 25 20:28:28 ait sshd[1747482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.118.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-01-25 20:28:58 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:37492: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.118.107
description:
Jan 25 20:28:28 ait sshd[1747482]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.118.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.208.224.29
description:
2025-01-25 20:28:39 dovecot_plain authenticator failed for syn-024-208-224-029.res.spectrum.com (matrances) [24.208.224.29]:36362: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.213.230
description:
Jan 25 20:28:46 ait sshd[1747558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.213.230


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 25 20:28:35 ait sshd[1747508]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.250.94
description:
Jan 25 20:28:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.250.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
description:
Jan 25 20:28:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.180.29.41
description:
Jan 25 20:28:16 ait sshd[1747455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.180.29.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
description:
2025-01-25 20:28:50 dovecot_plain authenticator failed for (nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:54098: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-25 20:29:06 dovecot_plain authenticator failed for ([5.159.173.105]) [5.159.173.105]:53146: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
description:
2025-01-25 20:28:12 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:50651: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
description:
Jan 25 20:28:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.213.230
description:
Jan 25 20:28:46 ait sshd[1747558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.213.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.250.94
description:
2025-01-25 20:28:50 dovecot_plain authenticator failed for ([60.11.250.94]) [60.11.250.94]:46408: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 25 20:29:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 25 20:28:35 ait sshd[1747508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
description:
Jan 25 20:28:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.180.29.41
description:
Jan 25 20:28:16 ait sshd[1747455]: pam_imunify(sshd:auth): [IM360_RBL] The IP 158.180.29.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.208.224.29
description:
Jan 25 20:28:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.208.224.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
description:
2025-01-25 20:29:00 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:36270: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.250.94
description:
Jan 25 20:29:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.250.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.250.94
description:
2025-01-25 20:29:29 dovecot_plain authenticator failed for ([60.11.250.94]) [60.11.250.94]:46603: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.46.114.239
description:
Jan 25 20:29:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.46.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 25 20:29:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.2.214.145
description:
2025-01-25 20:29:31 dovecot_plain authenticator failed for ([27.2.214.145]) [27.2.214.145]:33146: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-25 20:29:54 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:43310: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-25 20:29:18 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:48735: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-01-25 20:29:32 dovecot_plain authenticator failed for ([220.95.14.102]) [220.95.14.102]:41820: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Jan 25 20:29:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.198.59.254
description:
Jan 25 20:29:54 ait sshd[1748080]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.198.59.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 25 20:29:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-01-25 20:29:45 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:58872: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.4.10.114
description:
Jan 25 20:29:53 ait sshd[1748075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.10.114


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.4.10.114
description:
Jan 25 20:29:53 ait sshd[1748075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.4.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-01-25 20:29:18 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:54606: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.2.214.145
description:
Jan 25 20:29:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.2.214.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Jan 25 20:29:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 25 20:29:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.63.208
description:
2025-01-25 20:29:59 dovecot_plain authenticator failed for ([119.207.63.208]) [119.207.63.208]:44220: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Jan 25 20:29:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-01-25 20:29:47 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:45219: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.114.239
description:
2025-01-25 20:29:48 dovecot_plain authenticator failed for ([14.46.114.239]) [14.46.114.239]:52186: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.198.59.254
description:
Jan 25 20:29:54 ait sshd[1748080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.198.59.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.63.208
description:
Jan 25 20:29:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.63.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Jan 25 20:30:12 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.111.127
description:
Jan 25 20:30:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.111.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.239.160.200
description:
2025-01-25 20:30:31 dovecot_plain authenticator failed for ([218.239.160.200]) [218.239.160.200]:36950: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.73.243
description:
2025-01-25 20:30:40 dovecot_plain authenticator failed for ([65.76.73.243]) [65.76.73.243]:43510: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Jan 25 20:30:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-01-25 20:30:14 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:42214: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 25 20:30:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.73.243
description:
Jan 25 20:30:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.73.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-25 20:30:17 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:45333: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.211.130.219
description:
Jan 25 20:30:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.211.130.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.211.130.219
description:
2025-01-25 20:30:23 dovecot_plain authenticator failed for ([185.211.130.219]) [185.211.130.219]:56370: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Jan 25 20:30:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-01-25 20:30:28 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:42742: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-01-25 20:30:15 dovecot_plain authenticator failed for ([60.173.114.254]) [60.173.114.254]:54855: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.237.10
description:
Jan 25 20:30:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.237.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
description:
2025-01-25 20:30:20 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:39251: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.213.230
description:
Jan 25 20:30:26 ait sshd[1748442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.213.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.213.230
description:
Jan 25 20:30:26 ait sshd[1748442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.213.230


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.111.127
description:
2025-01-25 20:30:29 dovecot_plain authenticator failed for ([212.90.111.127]) [212.90.111.127]:52047: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.239.160.200
description:
Jan 25 20:30:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.239.160.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 20:30:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.198.59.254
description:
Jan 25 20:31:22 ait sshd[1748810]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.198.59.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.198.59.254
description:
Jan 25 20:31:22 ait sshd[1748810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.198.59.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-01-25 20:31:23 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:59834: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.88.72
description:
Jan 25 20:31:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.180.88.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-25 20:31:32 dovecot_plain authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:61146: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.4.10.114
description:
Jan 25 20:31:32 ait sshd[1748900]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.4.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Jan 25 20:31:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.213.230
description:
Jan 25 20:31:40 ait sshd[1748962]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.213.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.64
description:
2025-01-25 20:31:41 dovecot_plain authenticator failed for ([5.30.225.64]) [5.30.225.64]:59952: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Jan 25 20:31:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Jan 25 20:32:06 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 25 20:31:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.64
description:
Jan 25 20:31:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.213.230
description:
Jan 25 20:31:40 ait sshd[1748962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.213.230


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-25 20:31:37 dovecot_plain authenticator failed for (kesnesied) [2.110.10.192]:51760: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-01-25 20:32:08 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:60790: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.180.88.72
description:
2025-01-25 20:31:32 dovecot_plain authenticator failed for static-47-180-88-72.lsan.ca.frontiernet.net ([65.255.196.42]) [47.180.88.72]:47914: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.4.10.114
description:
Jan 25 20:31:32 ait sshd[1748900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.10.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-01-25 20:31:58 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:43072: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.59.254
description:
Jan 25 20:31:24 ait sshd[1748810]: Failed password for invalid user ubuntu from 124.198.59.254 port 41992 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.223.168.193
description:
Jan 25 20:31:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.223.168.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
description:
Jan 25 20:32:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-01-25 20:32:13 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:56332: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Jan 25 20:32:17 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-25 20:32:19 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:50009: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Jan 25 20:33:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.246.226
description:
Jan 25 20:33:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.246.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.240.117.170
description:
Jan 25 20:33:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.240.117.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 25 20:34:02 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Jan 25 20:34:03 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-01-25 20:34:05 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:36214: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 20:33:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-01-25 20:33:22 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:57798: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.126.246.226
description:
2025-01-25 20:33:33 dovecot_plain authenticator failed for ([129.126.246.226]) [129.126.246.226]:35260: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-25 20:34:23 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:58182: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.37.225
description:
Jan 25 20:34:43 ait sshd[1750557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.37.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
description:
2025-01-25 20:34:56 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:57950: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.202.222.229
description:
Jan 25 20:35:08 ait sshd[1751038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.202.222.229


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.118.107
description:
Jan 25 20:34:14 ait sshd[1750421]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.118.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.180.29.41
description:
Jan 25 20:34:20 ait sshd[1750484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.180.29.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 25 20:34:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
description:
Jan 25 20:34:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.249.193
description:
2025-01-25 20:35:07 dovecot_plain authenticator failed for ([210.177.249.193]) [210.177.249.193]:51239: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.202.222.229
description:
Jan 25 20:35:08 ait sshd[1751038]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.202.222.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.177.249.193
description:
Jan 25 20:35:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.177.249.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.37.225
description:
Jan 25 20:34:43 ait sshd[1750557]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.37.225 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.118.107
description:
Jan 25 20:34:14 ait sshd[1750421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.118.107


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.180.29.41
description:
Jan 25 20:34:20 ait sshd[1750484]: pam_imunify(sshd:auth): [IM360_RBL] The IP 158.180.29.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 25 20:34:12 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.120.14.140
description:
Jan 25 20:35:55 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.120.14.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.215
description:
Jan 25 20:35:17 ait sshd[1751094]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 25 20:35:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-25 20:35:42 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br (186-247-196-225.user.veloxzone.com.br) [186.247.196.106]:60789: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-25 20:35:50 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:56088: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.14.140
description:
2025-01-25 20:35:57 dovecot_plain authenticator failed for syn-070-120-014-140.res.spectrum.com [70.120.14.140]:58266: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.231.117
description:
Jan 25 20:35:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.231.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 25 20:35:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Jan 25 20:35:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-01-25 20:35:39 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:39822: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.202.222.229
description:
Jan 25 20:35:10 ait sshd[1751038]: Failed password for invalid user dev from 162.202.222.229 port 45356 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.215
description:
Jan 25 20:35:17 ait sshd[1751094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.215  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.231.117
description:
2025-01-25 20:35:33 dovecot_plain authenticator failed for p44117-obmd01.osaka.ocn.ne.jp [153.141.231.117]:41162: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.215
description:
Jan 25 20:35:36 ait sshd[1751094]: error: maximum authentication attempts exceeded for root from 218.92.0.215 port 28566 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 25 20:36:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-25 20:36:25 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:56866: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-25 20:36:17 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:40248: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Jan 25 20:36:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-01-25 20:36:15 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:18796: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 25 20:36:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
description:
2025-01-25 20:36:29 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:34612: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 20:36:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Jan 25 20:36:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 25 20:36:17 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
description:
Jan 25 20:36:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.76.135.189
description:
Jan 25 20:36:31 ait sshd[1751716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.135.189  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.153
description:
Jan 25 20:36:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.41.120
description:
Jan 25 20:37:14 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.41.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
description:
Jan 25 20:37:55 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.196.133
description:
Jan 25 20:37:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.196.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
description:
Jan 25 20:37:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
description:
2025-01-25 20:37:44 dovecot_plain authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:47348: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
description:
2025-01-25 20:37:57 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:45169: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
description:
Jan 25 20:38:08 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.163.16.40
description:
Jan 25 20:37:22 ait sshd[1752138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.163.16.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.124.42
description:
Jan 25 20:37:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.124.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.202.222.229
description:
Jan 25 20:38:04 ait sshd[1752440]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.202.222.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.153
description:
Jan 25 20:37:12 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.41.120
description:
2025-01-25 20:37:16 dovecot_plain authenticator failed for ([185.181.41.120]) [185.181.41.120]:55903: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 20:37:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.202.222.229
description:
Jan 25 20:38:04 ait sshd[1752440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.202.222.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.163.16.40
description:
[2025-01-25 20:37:19 +0100] info [whostmgrd] 85.163.16.40 - Kaisu1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.124.42
description:
2025-01-25 20:37:34 dovecot_plain authenticator failed for ([121.189.124.42]) [121.189.124.42]:38480: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.196.133
description:
2025-01-25 20:38:00 dovecot_plain authenticator failed for ([121.188.196.133]) [121.188.196.133]:56391: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.214.168.101
description:
2025-01-25 20:38:44 dovecot_login authenticator failed for d-24-214-168-101.oh.cpe.breezeline.net [24.214.168.101]:49252: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Jan 25 20:39:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 25 20:38:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-25 20:38:28 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:56050: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.37.225
description:
Jan 25 20:38:36 ait sshd[1752683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.37.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 25 20:38:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.208.158.150
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:(https:donesl_odmen||WPU:(https:donesl_odmen||RSV:6.65||T:APACHE||MV:20-38.185.208.158.150


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.208.158.150
domain: iric.us
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.37.225
description:
Jan 25 20:38:36 ait sshd[1752683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.37.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-25 20:38:45 dovecot_plain authenticator failed for ([93.182.160.222]) [93.182.160.222]:40716: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
description:
2025-01-25 20:38:10 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:47706: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.214.168.101
description:
Jan 25 20:38:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.214.168.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.114
description:
[2025-01-25 20:39:31 +0100] info [whostmgrd] 156.228.80.114 - ENG18B00217Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.67
description:
[2025-01-25 20:39:34 +0100] info [whostmgrd] 156.228.114.67 - ENG18B00217Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.104.172
description:
Jan 25 20:39:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.104.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.180.58
description:
Jan 25 20:40:02 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.180.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
description:
2025-01-25 20:40:05 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:51878: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.202.222.229
description:
Jan 25 20:39:23 ait sshd[1753029]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.202.222.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.202.222.229
description:
Jan 25 20:39:23 ait sshd[1753029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.202.222.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
description:
2025-01-25 20:39:52 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:39936: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
description:
2025-01-25 20:40:04 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:45767: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
description:
2025-01-25 20:39:11 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:47714: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.158
description:
[2025-01-25 20:39:21 +0100] info [cpaneld] 156.228.101.158 - ENG18B00217Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ENG18B00217Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.44
description:
[2025-01-25 20:39:23 +0100] info [cpaneld] 104.207.57.44 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.34.75
description:
[2025-01-25 20:39:25 +0100] info [cpaneld] 104.207.34.75 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.131
description:
[2025-01-25 20:39:33 +0100] info [whostmgrd] 156.228.94.131 - ENG18B00217Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.118.107
description:
Jan 25 20:39:47 ait sshd[1753161]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.118.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
description:
Jan 25 20:40:03 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.202.222.229
description:
Jan 25 20:39:25 ait sshd[1753029]: Failed password for invalid user test1 from 162.202.222.229 port 37150 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.162
description:
[2025-01-25 20:39:30 +0100] info [whostmgrd] 104.207.59.162 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.88
description:
[2025-01-25 20:39:32 +0100] info [whostmgrd] 156.228.110.88 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.118.107
description:
Jan 25 20:39:47 ait sshd[1753161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.118.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.104.172
description:
2025-01-25 20:39:50 dovecot_plain authenticator failed for ([65.76.104.172]) [65.76.104.172]:40038: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.79.133
description:
[2025-01-25 20:39:28 +0100] info [cpaneld] 156.228.79.133 - ENG18B00217Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ENG18B00217Y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
description:
Jan 25 20:39:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.51.102
description:
[2025-01-25 20:39:25 +0100] info [cpaneld] 104.207.51.102 - ENG18B00217Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ENG18B00217Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.134
description:
[2025-01-25 20:39:32 +0100] info [whostmgrd] 156.228.90.134 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.37.225
description:
Jan 25 20:40:12 ait sshd[1753695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.37.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-25 20:40:37 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (plavidae) [217.215.254.115]:43370: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.180.29.41
description:
Jan 25 20:40:33 ait sshd[1753801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 158.180.29.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.180.29.41
description:
Jan 25 20:40:33 ait sshd[1753801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.180.29.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Jan 25 20:40:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.37.225
description:
Jan 25 20:40:12 ait sshd[1753695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.37.225


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 25 20:42:10 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-25 20:42:12 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:60367: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 25 20:42:19 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-25 20:42:21 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:46870: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 20:42:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.18.74.207
description:
Jan 25 20:42:51 ait sshd[1754737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.18.74.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 20:43:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-01-25 20:43:16 dovecot_plain authenticator failed for ([122.187.243.95]) [122.187.243.95]:41015: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Jan 25 20:43:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 25 20:43:25 ait sshd[1755136]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 25 20:43:25 ait sshd[1755136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.0.69.202
description:
Jan 25 20:43:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.0.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.0.69.202
description:
2025-01-25 20:43:52 dovecot_plain authenticator failed for 191-0-69-202.host.telemar.net.br [191.0.69.202]:34139: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
description:
Jan 25 20:43:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Jan 25 20:43:14 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-01-25 20:43:23 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:41059: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
description:
2025-01-25 20:44:00 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:58562: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-25 20:44:25 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:36910: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.204.22
description:
Jan 25 20:44:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.204.22
description:
2025-01-25 20:44:41 dovecot_plain authenticator failed for ([196.46.204.22]) [196.46.204.22]:36318: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 25 20:45:00 ait sshd[1755584]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-25 20:44:13 dovecot_plain authenticator failed for (repumbled) [93.159.152.6]:48464: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 25 20:44:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 25 20:45:00 ait sshd[1755584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 25 20:44:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Jan 25 20:45:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-01-25 20:45:37 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:50380: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.243.5
description:
Jan 25 20:45:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.243.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.243.5
description:
2025-01-25 20:45:48 dovecot_plain authenticator failed for ([111.75.243.5]) [111.75.243.5]:36720: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 25 20:46:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-25 20:46:29 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (visantly) [54.38.80.107]:39782: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
description:
Jan 25 20:46:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.138.119.75
description:
2025-01-25 20:46:48 dovecot_login authenticator failed for (75-119-138-120.mysipl.com) [120.138.119.75]:47790: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.20
description:
Jan 25 20:46:51 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.138.119.75
description:
Jan 25 20:46:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.138.119.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.20
description:
2025-01-25 20:46:53 dovecot_plain authenticator failed for (201.218.181.20.viptel.com) [201.218.181.20]:49938: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.18.74.207
description:
Jan 25 20:46:15 ait sshd[1756298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.18.74.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
description:
Jan 25 20:46:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
description:
2025-01-25 20:46:32 dovecot_login authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:42980: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
description:
2025-01-25 20:46:44 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:34390: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
description:
Jan 25 20:47:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Jan 25 20:47:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.161
description:
Jan 25 20:47:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.161
description:
2025-01-25 20:47:46 dovecot_plain authenticator failed for (nlos-200-161.zamnet.zm) [196.46.200.161]:34434: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-01-25 20:47:37 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:54048: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
description:
2025-01-25 20:47:55 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:47293: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-01-25 20:48:42 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:37153: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.26.86
description:
Jan 25 20:48:51 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.26.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.26.86
description:
2025-01-25 20:48:53 dovecot_plain authenticator failed for ([65.76.26.86]) [65.76.26.86]:55988: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 20:48:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
description:
Jan 25 20:48:17 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
description:
2025-01-25 20:48:19 dovecot_plain authenticator failed for ([121.202.200.120]) [121.202.200.120]:15595: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Jan 25 20:48:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.160.128.46
description:
Jan 25 20:49:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.160.128.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-25 20:49:19 dovecot_login authenticator failed for ([106.51.92.248]) [106.51.92.248]:56296: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-25 20:49:22 dovecot_plain authenticator failed for (monmat) [109.160.123.6]:59866: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
description:
Jan 25 20:49:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Jan 25 20:50:07 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Jan 25 20:49:55 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Jan 25 20:49:17 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
description:
2025-01-25 20:49:20 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:50280: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
description:
2025-01-25 20:49:32 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:26378: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-01-25 20:49:57 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:36476: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Jan 25 20:49:10 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-01-25 20:49:12 dovecot_plain authenticator failed for (dynamicip-95-79-20-9.pppoe.nn.ertelecom.ru) [95.79.20.9]:55742: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 25 20:49:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-01-25 20:50:09 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:64208: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 20:50:19 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-01-25 20:53:04 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:34156: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Jan 25 20:53:02 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.63.214.213
description:
Jan 25 20:53:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.63.214.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
description:
2025-01-25 20:53:20 dovecot_plain authenticator failed for ([58.63.214.213]) [58.63.214.213]:9927: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.219.228.112
description:
Jan 25 20:53:55 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.219.228.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 25 20:54:34 ait sshd[1759833]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 25 20:54:34 ait sshd[1759833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.226.69
description:
Jan 25 20:55:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.226.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.226.69
description:
2025-01-25 20:55:36 dovecot_plain authenticator failed for (ractroic) [85.105.226.69]:50010: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.232.175.64
description:
Jan 25 20:56:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.232.175.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.232.175.64
description:
2025-01-25 20:56:48 dovecot_plain authenticator failed for ([37.232.175.64]) [37.232.175.64]:42288: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 25 20:56:49 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-25 20:56:51 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (prony) [54.38.80.107]:60690: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 25 20:56:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-25 20:56:56 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:44484: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 25 20:56:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-25 20:56:15 dovecot_plain authenticator failed for (panted) [102.53.15.17]:42489: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.123.153
description:
2025-01-25 20:57:38 dovecot_plain authenticator failed for ([24.224.123.153]) [24.224.123.153]:52832: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.85.39.104
description:
Jan 25 20:57:41 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.85.39.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Jan 25 20:57:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
description:
Jan 25 20:57:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-25 20:57:28 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:42370: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.39.104
description:
2025-01-25 20:57:43 dovecot_plain authenticator failed for ([208.85.39.104]) [208.85.39.104]:46652: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-01-25 20:57:48 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:60952: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
description:
Jan 25 20:57:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 25 20:57:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
description:
Jan 25 20:57:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
description:
2025-01-25 20:57:44 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:48166: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
description:
2025-01-25 20:58:00 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:45896: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.37.90
description:
Jan 25 20:57:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.37.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.224.123.153
description:
Jan 25 20:57:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.224.123.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 20:57:41 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
description:
2025-01-25 20:57:25 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:59284: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
description:
2025-01-25 20:57:27 dovecot_plain authenticator failed for ([185.232.37.90]) [185.232.37.90]:36430: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-01-25 20:58:48 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:58770: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 25 20:58:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-25 20:58:59 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:18584: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Jan 25 20:58:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
description:
2025-01-25 20:59:46 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:43771: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
description:
2025-01-25 21:00:02 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:57436: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
description:
Jan 25 20:59:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
description:
2025-01-25 20:59:13 dovecot_login authenticator failed for ([60.174.40.155]) [60.174.40.155]:42165: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 25 20:59:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
description:
Jan 25 20:59:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Jan 25 20:59:59 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-01-25 20:59:41 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:33623: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
description:
2025-01-25 20:59:47 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:38640: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Jan 25 20:59:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-25 20:59:22 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:34848: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-01-25 20:59:33 dovecot_login authenticator failed for ([222.128.44.171]) [222.128.44.171]:2187: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Jan 25 20:59:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
description:
Jan 25 21:00:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-25 21:00:01 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:42390: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.221.21
description:
Jan 25 20:59:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Jan 25 20:59:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
description:
2025-01-25 20:59:33 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:51886: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
description:
Jan 25 20:59:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-01-25 20:59:55 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:39599: 535 Incorrect authentication data (set_id=assdas3)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 31.220.40.210
domain: www.accete.aitonline.us
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.git/config||RSV:6.65||T:APACHE||


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 25 21:01:16 ait sshd[1762841]: Invalid user universitypublishing from 210.180.118.166 port 56850


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 25 21:01:17 ait sshd[1762841]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 25 21:01:17 ait sshd[1762841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.120.97
description:
2025-01-25 21:02:37 dovecot_plain authenticator failed for v2202501250131308547.bestsrv.de [152.53.120.97]:60182: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.57.253.254
description:
Jan 25 21:02:47 ait sshd[1763623]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.57.253.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.57.253.254
description:
Jan 25 21:02:47 ait sshd[1763623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.57.253.254  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.96.133
description:
Jan 25 21:03:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.96.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.96.133
description:
2025-01-25 21:03:02 dovecot_plain authenticator failed for ([61.185.96.133]) [61.185.96.133]:39955: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.89.143.234
description:
Jan 25 21:02:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.89.143.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.89.143.234
description:
2025-01-25 21:02:29 dovecot_plain authenticator failed for ([222.89.143.234]) [222.89.143.234]:47928: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.120.97
description:
Jan 25 21:02:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.120.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.104.209
description:
Jan 25 21:04:06 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.104.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-01-25 21:03:12 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:35474: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.184.80
description:
Jan 25 21:03:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Jan 25 21:03:10 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
description:
2025-01-25 21:03:26 dovecot_plain authenticator failed for (thyogred) [65.20.184.80]:54456: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 25 21:04:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.142.8
description:
2025-01-25 21:04:42 dovecot_plain authenticator failed for 95-165-142-8.static.spd-mgts.ru [95.165.142.8]:56098: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.30.139.251
description:
Jan 25 21:04:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.30.139.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.40.8.116
description:
Jan 25 21:04:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.40.8.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.30.139.251
description:
2025-01-25 21:04:13 dovecot_plain authenticator failed for ([120.55.170.138]) [116.30.139.251]:7858: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.57.253.254
description:
Jan 25 21:04:36 ait sshd[1763655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.57.253.254  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.142.8
description:
Jan 25 21:04:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.142.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.13.9
description:
2025-01-25 21:05:09 dovecot_plain authenticator failed for (heangmely) [81.211.13.9]:53598: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.104.209
description:
Jan 25 21:04:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.104.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.40.8.116
description:
2025-01-25 21:04:29 dovecot_plain authenticator failed for host116.sub-63-40-8.myvzw.com [63.40.8.116]:36174: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.57.253.254
description:
Jan 25 21:04:36 ait sshd[1763655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.57.253.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-01-25 21:05:34 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:47934: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Jan 25 21:05:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-01-25 21:05:45 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:42866: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
description:
2025-01-25 21:05:58 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:43099: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 25 21:05:17 ait sshd[1764813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 25 21:05:17 ait sshd[1764813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.238
description:
2025-01-25 21:05:30 dovecot_plain authenticator failed for ([221.195.208.238]) [221.195.208.238]:58338: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-25 21:05:40 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:60542: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
description:
Jan 25 21:05:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 25 21:05:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 25 21:05:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.238
description:
Jan 25 21:05:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Jan 25 21:05:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 21:05:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-25 21:05:46 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:34590: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 25 21:07:07 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-25 21:07:09 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:44282: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 21:06:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 21:07:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.107.173.210
description:
2025-01-25 21:08:01 dovecot_plain authenticator failed for (177-107-173-210.unifique.net) [177.107.173.210]:37627: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 25 21:08:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Jan 25 21:08:07 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Jan 25 21:07:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 25 21:07:22 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 21:07:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-01-25 21:07:20 dovecot_plain authenticator failed for (187-8-108-170.customer.tdatabrasil.net.br) [189.56.217.183]:33206: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
description:
Jan 25 21:07:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.107.173.210
description:
Jan 25 21:07:59 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.107.173.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-25 21:08:48 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:21721: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 25 21:08:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.41.120
description:
2025-01-25 21:08:29 dovecot_plain authenticator failed for ([185.181.41.120]) [185.181.41.120]:45958: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Jan 25 21:08:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-01-25 21:08:39 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:51110: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.21.235.162
description:
Jan 25 21:08:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.21.235.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
description:
2025-01-25 21:08:52 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:52678: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.41.120
description:
Jan 25 21:08:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.41.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.66
description:
2025-01-25 21:08:45 dovecot_login authenticator failed for ([92.118.39.66]) [92.118.39.66]:54839: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
description:
2025-01-25 21:08:45 dovecot_plain authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:35911: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.9.236
description:
Jan 25 21:08:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.9.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 21:08:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
description:
2025-01-25 21:08:58 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:43856: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.42.235.92
description:
2025-01-25 21:09:04 dovecot_plain authenticator failed for s92-235-42-8.bcec.tx.wi-power.com [8.42.235.92]:38234: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
description:
Jan 25 21:08:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 25 21:08:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.123.40.94
description:
Jan 25 21:08:49 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.123.40.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.123.40.94
description:
2025-01-25 21:08:51 dovecot_plain authenticator failed for (124.123.40.94.actcorp.in) [124.123.40.94]:2957: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.9.236
description:
2025-01-25 21:08:11 dovecot_plain authenticator failed for ([210.21.9.236]) [210.21.9.236]:42733: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 25 21:08:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 21:09:06 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
description:
Jan 25 21:08:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Jan 25 21:08:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 25 21:08:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.66
description:
Jan 25 21:08:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.74.70
description:
Jan 25 21:09:15 ait sshd[1765794]: Failed password for invalid user ait from 89.116.74.70 port 49844 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 25 21:09:30 ait sshd[1766513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 25 21:09:38 ait sshd[1766701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-25 21:10:00 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:49264: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
description:
Jan 25 21:10:08 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 25 21:09:30 ait sshd[1766513]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.130.227.80
description:
Jan 25 21:09:31 ait sshd[1766672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.130.227.80


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 25 21:09:38 ait sshd[1766701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
description:
2025-01-25 21:09:14 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:53389: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.227.80
description:
Jan 25 21:09:31 ait sshd[1766672]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.130.227.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
description:
Jan 25 21:09:12 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Jan 25 21:09:12 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.116.74.70
description:
Jan 25 21:09:13 ait sshd[1765794]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.116.74.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.116.74.70
description:
Jan 25 21:09:13 ait sshd[1765794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.116.74.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-01-25 21:09:14 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:44050: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.221
description:
Jan 25 21:09:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 25 21:09:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.29.98
description:
47.128.29.98 - - [25/Jan/2025:21:09:56 +0100] "GET /wp-content/plugins/buddypress/bp-members/css/blocks/dynamic-members.min.css HTTP/2.0" 200 1531 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23507989" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.29.98


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.221
description:
2025-01-25 21:09:58 dovecot_plain authenticator failed for ([113.64.208.221]) [113.64.208.221]:38894: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.45.11
description:
47.128.45.11 - - [25/Jan/2025:21:10:20 +0100] "GET /wp-content/plugins/buddypress/bp-members/css/blocks/members.min.css HTTP/2.0" 200 1491 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23323772" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.45.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 21:10:37 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-01-25 21:10:47 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:49869: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 25 21:11:06 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
description:
2025-01-25 21:10:10 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:50220: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Jan 25 21:10:14 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-01-25 21:10:16 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:49728: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Jan 25 21:10:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-25 21:11:08 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:43502: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-25 21:11:54 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:40210: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.3.72
description:
2025-01-25 21:11:58 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:56556: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.134.109.119
description:
Jan 25 21:11:10 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.134.109.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.134.109.119
description:
2025-01-25 21:11:12 dovecot_plain authenticator failed for ([67.134.109.119]) [67.134.109.119]:41605: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.63.216
description:
2025-01-25 21:11:30 dovecot_plain authenticator failed for (ankle) [178.165.63.216]:33025: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Jan 25 21:11:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 25 21:11:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
description:
Jan 25 21:11:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-01-25 21:11:32 dovecot_plain authenticator failed for ([39.174.90.43]) [39.174.90.43]:56941: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
description:
Jan 25 21:11:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
description:
2025-01-25 21:11:45 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:56106: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.142.14
description:
Jan 25 21:12:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.142.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-25 21:11:42 dovecot_plain authenticator failed for ([116.90.97.209]) [116.90.97.209]:33030: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-25 21:11:45 dovecot_login authenticator failed for ([58.216.101.166]) [58.216.101.162]:60555: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 25 21:11:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 25 21:11:22 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Jan 25 21:11:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.165.63.216
description:
Jan 25 21:11:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.165.63.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-01-25 21:11:30 dovecot_plain authenticator failed for ([50.81.70.80]) [50.81.70.80]:46106: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 25 21:11:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.3.72
description:
Jan 25 21:11:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.3.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-25 21:11:24 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:48240: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-01-25 21:11:41 dovecot_plain authenticator failed for ([221.13.138.138]) [221.13.138.138]:44885: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.142.14
description:
2025-01-25 21:12:07 dovecot_plain authenticator failed for ([39.164.142.14]) [39.164.142.14]:9114: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.238.190.123
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:21-12.213.238.190.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 25 21:12:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Jan 25 21:13:01 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.36.155.187
description:
2025-01-25 21:12:17 dovecot_plain authenticator failed for ([136.36.155.187]) [136.36.155.187]:44714: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-25 21:12:47 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:8029: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-01-25 21:13:03 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:56145: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 21:13:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.36.155.187
description:
Jan 25 21:12:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.36.155.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
description:
Jan 25 21:13:19 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Jan 25 21:13:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
description:
2025-01-25 21:13:21 dovecot_plain authenticator failed for ([41.214.10.178]) [41.214.10.178]:58934: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-01-25 21:13:22 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:64926: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
description:
Jan 25 21:13:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Jan 25 21:13:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-01-25 21:13:36 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:55263: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.69.63.53
description:
[2025-01-25 21:13:14 +0100] info [webmaild] 105.69.63.53 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 21:14:01 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
description:
2025-01-25 21:13:29 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:34484: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 25 21:15:03 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.110.43
description:
[2025-01-25 21:14:19 +0100] info [webmaild] 45.237.110.43 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.172.167
description:
[2025-01-25 21:14:38 +0100] info [webmaild] 170.244.172.167 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.207.152.163
description:
Jan 25 21:14:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.207.152.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.163
description:
2025-01-25 21:14:45 dovecot_plain authenticator failed for ([102.207.152.163]) [102.207.152.163]:45035: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.32.62.98
description:
[2025-01-25 21:14:54 +0100] info [webmaild] 5.32.62.98 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.67.218
description:
Jan 25 21:14:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.67.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.218
description:
2025-01-25 21:14:56 dovecot_plain authenticator failed for ([103.58.67.218]) [103.58.67.218]:40200: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-25 21:15:05 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:58587: 535 Incorrect authentication data (set_id=testuser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Jan 25 21:15:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-01-25 21:15:40 dovecot_login authenticator failed for ([197.231.129.154]) [197.231.129.154]:33138: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.126.156.22
description:
2025-01-25 21:15:52 dovecot_login authenticator failed for ([119.126.156.22]) [119.126.156.22]:26014: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.126.156.22
description:
Jan 25 21:15:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.126.156.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 25 21:16:08 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.214
description:
2025-01-25 21:16:32 dovecot_plain authenticator failed for ([61.185.226.214]) [61.185.226.214]:54578: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-25 21:16:27 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:49098: 535 Incorrect authentication data (set_id=akoto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.214
description:
Jan 25 21:16:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.117.168.44
description:
2025-01-25 21:16:30 dovecot_plain authenticator failed for syn-068-117-168-044.res.spectrum.com [68.117.168.44]:59507: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-25 21:16:10 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:49729: 535 Incorrect authentication data (set_id=akoto@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.117.168.44
description:
Jan 25 21:16:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.117.168.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Jan 25 21:16:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.85.39.104
description:
Jan 25 21:16:51 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.85.39.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.39.104
description:
2025-01-25 21:16:53 dovecot_plain authenticator failed for ([208.85.39.104]) [208.85.39.104]:48332: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Jan 25 21:16:19 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
description:
Jan 25 21:16:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-01-25 21:16:41 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:41626: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.25.70
description:
Jan 25 21:17:01 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.25.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.25.70
description:
2025-01-25 21:17:03 dovecot_plain authenticator failed for ([39.129.25.70]) [39.129.25.70]:54117: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-01-25 21:16:21 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:33219: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
description:
2025-01-25 21:17:23 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:42612: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.186.104
description:
Jan 25 21:17:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.186.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.126.186.104
description:
2025-01-25 21:17:58 dovecot_plain authenticator failed for ([129.126.186.104]) [129.126.186.104]:54787: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 25 21:18:09 ait sshd[1770773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.141
description:
2025-01-25 21:17:29 dovecot_login authenticator failed for ([112.102.48.141]) [112.102.48.141]:34912: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.30.239
description:
2025-01-25 21:17:37 dovecot_login authenticator failed for ([14.46.30.239]) [14.46.30.239]:59503: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-25 21:17:42 dovecot_login authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:56455: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.64.214.198
description:
2025-01-25 21:17:42 dovecot_plain authenticator failed for ([222.64.214.198]) [222.64.214.198]:43018: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 25 21:18:09 ait sshd[1770773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.141
description:
Jan 25 21:17:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.46.30.239
description:
Jan 25 21:17:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.46.30.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.64.214.198
description:
Jan 25 21:17:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.64.214.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
description:
Jan 25 21:17:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 25 21:17:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 25 21:18:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-25 21:18:59 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:63646: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 25 21:18:22 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-25 21:18:24 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (nasics) [81.16.170.117]:56122: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
description:
2025-01-25 21:18:46 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:36046: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 25 21:18:51 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-25 21:18:53 dovecot_plain authenticator failed for (pereourn) [77.51.214.170]:49746: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 25 21:18:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-25 21:18:29 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:65473: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
description:
Jan 25 21:18:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.13.9
description:
2025-01-25 21:19:45 dovecot_plain authenticator failed for (crorefid) [81.211.13.9]:60440: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 25 21:19:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.13.9
description:
Jan 25 21:19:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.13.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 25 21:19:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-25 21:19:28 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (gates) [2.139.88.148]:49952: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.224.198
description:
2025-01-25 21:19:40 dovecot_plain authenticator failed for (carid) [65.20.224.198]:48892: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 25 21:19:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 25 21:20:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.169.244
description:
Jan 25 21:19:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.169.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.169.244
description:
2025-01-25 21:19:29 dovecot_plain authenticator failed for lstlambert-656-1-118-244.w80-14.abo.wanadoo.fr (pinespolie) [80.14.169.244]:39448: 535 Incorrect authentication data (set_id=ads21b00172y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
description:
Jan 25 21:19:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-25 21:19:46 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (hysonwers) [81.16.170.117]:46018: 535 Incorrect authentication data (set_id=ads76b66779y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-25 21:19:46 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (noniferk) [109.67.154.24]:43856: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-25 21:20:02 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:48539: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 21:19:28 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.171
description:
2025-01-25 21:21:06 dovecot_plain authenticator failed for (agaticaph) [65.20.129.171]:54162: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-25 21:21:08 dovecot_plain authenticator failed for (jahato) [95.79.108.51]:50860: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.69.202
description:
Jan 25 21:20:15 ait sshd[1771942]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
description:
Jan 25 21:20:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
description:
2025-01-25 21:20:50 dovecot_plain authenticator failed for (choldeene) [65.20.253.152]:37869: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.171
description:
Jan 25 21:21:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.177.204.122
description:
Jan 25 21:20:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.177.204.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
description:
2025-01-25 21:20:15 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:35906: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 21:20:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.204.122
description:
2025-01-25 21:20:50 dovecot_plain authenticator failed for (kazzless) [154.177.204.122]:55416: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 25 21:21:06 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
description:
Jan 25 21:20:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.69.202
description:
Jan 25 21:20:15 ait sshd[1771942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.69.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 25 21:21:51 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.73
description:
Jan 25 21:21:59 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.73
description:
2025-01-25 21:22:01 dovecot_login authenticator failed for ([193.32.162.73]) [193.32.162.73]:53410: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.83
description:
Jan 25 21:22:07 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 25 21:21:16 ait sshd[1772402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 25 21:21:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.97
description:
2025-01-25 21:22:03 dovecot_login authenticator failed for ([193.32.162.97]) [193.32.162.97]:56823: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.66
description:
2025-01-25 21:22:01 dovecot_login authenticator failed for ([193.32.162.66]) [193.32.162.66]:65107: 535 Incorrect authentication data (set_id=backup)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.13.9
description:
Jan 25 21:21:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.13.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-25 21:21:53 dovecot_plain authenticator failed for (puparic) [147.235.97.158]:64685: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-25 21:21:59 dovecot_plain authenticator failed for (unicuce) [46.30.161.197]:53898: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.97
description:
Jan 25 21:22:01 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.97 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 25 21:21:16 ait sshd[1772402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.13.9
description:
2025-01-25 21:21:34 dovecot_plain authenticator failed for (poecres) [81.211.13.9]:44310: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.66
description:
Jan 25 21:21:59 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-25 21:22:26 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (unmontoric) [109.67.154.24]:39698: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 25 21:22:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-25 21:22:50 dovecot_plain authenticator failed for (glesevok) [77.51.214.170]:36113: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.206
description:
Jan 25 21:22:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.206
description:
2025-01-25 21:22:55 dovecot_plain authenticator failed for (slierhable) [65.20.168.206]:45145: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.83
description:
2025-01-25 21:22:09 dovecot_login authenticator failed for ([193.32.162.83]) [193.32.162.83]:55824: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
description:
Jan 25 21:22:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.81
description:
2025-01-25 21:22:11 dovecot_login authenticator failed for ([193.32.162.81]) [193.32.162.81]:50547: 535 Incorrect authentication data (set_id=fax)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 25 21:22:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 21:22:57 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.81
description:
Jan 25 21:22:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
description:
2025-01-25 21:22:13 dovecot_plain authenticator failed for (equing) [65.20.253.152]:41270: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-25 21:23:17 dovecot_plain authenticator failed for (chillsia) [102.53.15.54]:45345: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 21:23:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 25 21:23:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-25 21:23:58 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (woodesiste) [85.69.178.104]:40764: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 25 21:23:08 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-25 21:23:10 dovecot_plain authenticator failed for (salers) [102.53.15.17]:59104: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 25 21:23:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 25 21:24:12 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 21:24:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-25 21:24:14 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (amandomble) [81.225.30.107]:41780: 535 Incorrect authentication data (set_id=abs68a66678y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.69.202
description:
Jan 25 21:24:25 ait sshd[1774017]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.69.202
description:
Jan 25 21:24:25 ait sshd[1774017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.69.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 21:25:44 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.69.202
description:
Jan 25 21:25:54 ait sshd[1774864]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.69.202
description:
Jan 25 21:25:54 ait sshd[1774864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.69.202


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.69.202
description:
Jan 25 21:25:56 ait sshd[1774864]: Failed password for invalid user postgres from 162.240.69.202 port 53666 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 25 21:25:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-25 21:25:22 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (evoldally) [81.237.110.29]:53426: 535 Incorrect authentication data (set_id=bscj21bit1157y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Jan 25 21:26:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.194
description:
Jan 25 21:26:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.194
description:
2025-01-25 21:26:25 dovecot_login authenticator failed for (m121-202-196-194.smartone.com) [121.202.196.194]:14427: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 25 21:26:27 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 25 21:26:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-25 21:26:13 dovecot_login authenticator failed for ([211.52.131.183]) [211.52.131.183]:40751: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 25 21:26:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-25 21:26:29 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (trated) [83.233.242.245]:49268: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-25 21:26:23 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:36836: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.161.111
description:
2025-01-25 21:27:00 dovecot_login authenticator failed for p90112-obmd01.osaka.ocn.ne.jp [180.7.161.111]:42545: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-01-25 21:27:00 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (serontion) [2.36.64.247]:57321: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.51.104.214
description:
Jan 25 21:26:47 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.51.104.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.51.104.214
description:
2025-01-25 21:26:49 dovecot_plain authenticator failed for (erctria) [94.51.104.214]:55990: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.161.111
description:
Jan 25 21:26:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.161.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.10.89.25
description:
2025-01-25 21:27:24 dovecot_plain authenticator failed for (reble) [85.10.89.25]:58662: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 25 21:27:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-25 21:27:54 dovecot_plain authenticator failed for (parome) [46.30.161.197]:48959: 535 Incorrect authentication data (set_id=bscj21bit1157y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.177.34
description:
Jan 25 21:27:10 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.177.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.177.34
description:
2025-01-25 21:27:12 dovecot_login authenticator failed for ([183.233.177.34]) [183.233.177.34]:46818: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.10.89.25
description:
Jan 25 21:27:22 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.10.89.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-01-25 21:28:13 dovecot_login authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:57890: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.57.106
description:
Jan 25 21:28:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.57.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.154.82
description:
Jan 25 21:28:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.154.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.33
description:
2025-01-25 21:28:48 dovecot_plain authenticator failed for (diuming) [65.20.170.33]:47454: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.105.65.78
description:
Jan 25 21:29:03 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.105.65.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-25 21:28:21 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:33014: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.57.106
description:
2025-01-25 21:28:25 dovecot_login authenticator failed for ([65.76.57.106]) [65.76.57.106]:35042: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.170.33
description:
Jan 25 21:28:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.170.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-25 21:28:58 dovecot_login authenticator failed for ([58.229.51.205]) [58.229.51.205]:35516: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Jan 25 21:28:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 25 21:28:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 25 21:29:04 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-25 21:29:06 dovecot_plain authenticator failed for (boell) [185.65.238.250]:51635: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 25 21:28:19 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.154.82
description:
2025-01-25 21:28:35 dovecot_login authenticator failed for ([58.17.154.82]) [58.17.154.82]:38450: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 25 21:28:41 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-25 21:28:43 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (crionid) [81.143.51.58]:58317: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.105.65.78
description:
2025-01-25 21:29:05 dovecot_login authenticator failed for 65-105-177-78.netprimus.net.br [177.105.65.78]:47400: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.190
description:
Jan 25 21:29:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.184.119.106
description:
2025-01-25 21:29:32 dovecot_login authenticator failed for ([117.184.119.106]) [117.184.119.106]:30992: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 25 21:29:59 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
description:
Jan 25 21:30:01 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
description:
2025-01-25 21:30:03 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:57586: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
description:
2025-01-25 21:29:18 dovecot_login authenticator failed for ([183.230.165.58]) [183.230.165.58]:42292: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
description:
2025-01-25 21:29:23 dovecot_login authenticator failed for ([50.201.37.210]) [50.201.37.210]:62335: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
description:
2025-01-25 21:29:32 dovecot_login authenticator failed for ([178.178.194.131]) [178.178.194.131]:33128: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-25 21:29:45 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:58588: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.42.235.92
description:
2025-01-25 21:29:11 dovecot_login authenticator failed for s92-235-42-8.bcec.tx.wi-power.com [8.42.235.92]:50466: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.190
description:
2025-01-25 21:29:11 dovecot_plain authenticator failed for (alcry) [2.110.10.190]:44090: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.43.202.110
description:
2025-01-25 21:29:13 dovecot_login authenticator failed for ([31.43.202.110]) [31.43.202.110]:60526: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
description:
Jan 25 21:29:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-25 21:30:01 dovecot_login authenticator failed for (mail.salee.co.kr) [220.90.239.158]:47807: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.184.53.83
description:
2025-01-25 21:29:51 dovecot_login authenticator failed for (default-rdns.vocus.co.nz) [203.184.53.83]:33491: 535 Incorrect authentication data (set_id=eng20a00114y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.190
description:
Jan 25 21:29:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.184.119.106
description:
Jan 25 21:29:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.184.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.190
description:
2025-01-25 21:29:32 dovecot_login authenticator failed for ([189.39.187.16]) [189.39.187.190]:36705: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.184.53.83
description:
Jan 25 21:29:49 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.184.53.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
description:
Jan 25 21:29:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
description:
Jan 25 21:29:21 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-25 21:29:45 dovecot_login authenticator failed for ([218.98.26.226]) [58.216.101.162]:34513: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 25 21:30:06 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-25 21:30:08 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56774: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.42.235.92
description:
Jan 25 21:29:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.42.235.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.43.202.110
description:
Jan 25 21:29:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.43.202.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 25 21:29:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 25 21:29:43 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.230.95.235
description:
Jan 25 21:30:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.230.95.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
description:
2025-01-25 21:30:41 dovecot_login authenticator failed for ([114.241.245.198]) [114.241.245.198]:55197: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.231.207
description:
Jan 25 21:31:01 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.231.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.28.145
description:
Jan 25 21:30:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.28.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Jan 25 21:30:17 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-01-25 21:30:19 dovecot_login authenticator failed for ([38.49.182.103]) [38.49.182.103]:35638: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-01-25 21:30:24 dovecot_login authenticator failed for ([116.124.241.138]) [116.124.241.138]:48732: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.25.70
description:
Jan 25 21:30:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.25.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.206.231.207
description:
2025-01-25 21:31:03 dovecot_login authenticator failed for ([109.206.231.207]) [109.206.231.207]:57994: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.177.194
description:
Jan 25 21:30:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-01-25 21:30:17 dovecot_login authenticator failed for ([75.110.132.232]) [75.110.132.232]:60994: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 25 21:30:19 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 25 21:30:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.177.194
description:
2025-01-25 21:30:15 dovecot_login authenticator failed for ([124.115.177.194]) [124.115.177.194]:51912: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
description:
Jan 25 21:30:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
description:
Jan 25 21:30:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-25 21:30:21 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:49538: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
description:
2025-01-25 21:30:28 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:53156: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.25.70
description:
2025-01-25 21:30:47 dovecot_login authenticator failed for ([39.129.25.70]) [39.129.25.70]:50573: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Jan 25 21:30:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 25 21:30:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-25 21:30:26 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:38460: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-01-25 21:30:38 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:59086: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Jan 25 21:30:22 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-25 21:30:25 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:58449: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 21:30:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.230.95.235
description:
2025-01-25 21:30:38 dovecot_login authenticator failed for (abts-ap-dynamic-235.95.230.223.airtelbroadband.in) [223.230.95.235]:52900: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 25 21:30:23 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
description:
Jan 25 21:30:39 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Jan 25 21:30:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.47.95
description:
2025-01-25 21:30:36 dovecot_login authenticator failed for p387096-obmd01.tokyo.ocn.ne.jp [60.45.47.95]:50045: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
description:
2025-01-25 21:30:17 dovecot_login authenticator failed for ([221.10.221.104]) [221.10.221.104]:60700: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.145
description:
2025-01-25 21:30:18 dovecot_login authenticator failed for 111-70-28-145.emome-ip.hinet.net [111.70.28.145]:49719: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-25 21:30:31 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:41914: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.47.95
description:
Jan 25 21:30:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.47.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.37.35.186
description:
Jan 25 21:31:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.37.35.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-25 21:31:51 dovecot_login authenticator failed for ([121.202.155.240]) [121.202.155.240]:27971: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.138.119.75
description:
2025-01-25 21:31:56 dovecot_login authenticator failed for (75-119-138-120.mysipl.com) [120.138.119.75]:57306: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 25 21:31:45 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Jan 25 21:31:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-01-25 21:31:15 dovecot_login authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:43196: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 25 21:31:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-25 21:31:47 dovecot_login authenticator failed for ([1.245.207.104]) [1.245.207.104]:44802: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.126.156.22
description:
Jan 25 21:31:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.126.156.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.188.139
description:
Jan 25 21:31:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.188.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.138.119.75
description:
Jan 25 21:31:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.138.119.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.188.139
description:
2025-01-25 21:31:34 dovecot_login authenticator failed for ([220.248.188.139]) [220.248.188.139]:50424: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-01-25 21:31:34 dovecot_login authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:49079: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 25 21:31:49 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
description:
Jan 25 21:31:20 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Jan 25 21:31:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Jan 25 21:31:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.35.186
description:
2025-01-25 21:31:50 dovecot_login authenticator failed for ([136.232.73.130]) [49.37.35.186]:38288: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Jan 25 21:31:48 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-01-25 21:31:22 dovecot_login authenticator failed for ([196.28.226.123]) [196.28.226.123]:40405: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.20.197
description:
2025-01-25 21:31:31 dovecot_login authenticator failed for ([65.76.20.197]) [65.76.20.197]:49388: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
description:
2025-01-25 21:31:35 dovecot_login authenticator failed for ([110.189.153.136]) [110.189.153.136]:50865: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-01-25 21:31:50 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:56560: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.126.156.22
description:
2025-01-25 21:31:13 dovecot_login authenticator failed for ([119.126.156.22]) [119.126.156.22]:26573: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-25 21:31:27 dovecot_login authenticator failed for ([27.71.27.81]) [27.71.27.81]:42122: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.20.197
description:
Jan 25 21:31:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.20.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-25 21:32:33 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:52097: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 25 21:32:59 ait sshd[1778534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.105.146.223
description:
Jan 25 21:32:27 ait sshd[1778266]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.105.146.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 25 21:32:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 25 21:32:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-25 21:32:15 dovecot_login authenticator failed for ([112.111.61.230]) [112.111.61.229]:50874: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.105.146.223
description:
Jan 25 21:32:27 ait sshd[1778266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.105.146.223  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 25 21:32:59 ait sshd[1778534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
description:
Jan 25 21:32:11 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-01-25 21:32:13 dovecot_login authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:53172: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 25 21:32:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 21:33:52 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 25 21:33:53 ait sshd[1778818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 25 21:33:53 ait sshd[1778818]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.247.249.10
description:
2025-01-25 21:33:56 dovecot_login authenticator failed for ([61.247.249.10]) [61.247.249.10]:51400: 535 Incorrect authentication data (set_id=akoto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 25 21:33:41 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-25 21:33:43 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:34701: 535 Incorrect authentication data (set_id=akoto@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.247.249.10
description:
Jan 25 21:33:54 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.247.249.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 25 21:34:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-25 21:34:33 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:63948: 535 Incorrect authentication data (set_id=spam)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.105.146.223
description:
Jan 25 21:34:50 ait sshd[1779354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.105.146.223  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 21:34:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.105.146.223
description:
Jan 25 21:34:50 ait sshd[1779354]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.105.146.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.213.187.41
description:
Jan 25 21:36:49 ait sshd[1780319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.213.187.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.213.187.41
description:
Jan 25 21:36:49 ait sshd[1780319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.213.187.41


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.49.125
description:
Jan 25 21:37:16 ait sshd[1780576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.102.49.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.102.49.125
description:
Jan 25 21:37:16 ait sshd[1780576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.102.49.125


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.186
description:
Jan 25 21:38:15 ait sshd[1780924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.186
description:
Jan 25 21:38:15 ait sshd[1780924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.211
description:
Jan 25 21:38:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.211
description:
2025-01-25 21:38:52 dovecot_login authenticator failed for ([195.178.110.211]) [195.178.110.211]:54942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
description:
Jan 25 21:39:51 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
description:
2025-01-25 21:39:53 dovecot_login authenticator failed for ([103.146.233.121]) [103.146.233.121]:52986: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-01-25 21:40:02 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:36122: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77318034
name: IM360 WAF: Blocked access to git folder
abuser: 54.89.58.252
domain: ait.edu.gh
description:
IM360 WAF: Blocked access to git folder||RSV:6.65||T:APACHE||MV:/application/login.php/.git/config||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.122.253.129
description:
Jan 25 21:39:22 ait sshd[1781343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.122.253.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.122.253.129
description:
Jan 25 21:39:22 ait sshd[1781343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.253.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Jan 25 21:40:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 54.89.58.252
domain: ait.edu.gh
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/application/login.php/.git/config||RSV:6.65||T:APACHE||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.249.43.219
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-39.173.249.43.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 21:40:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 87.120.127.88
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:edu||WPU:edu||RSV:6.65||T:APACHE||MV:21-41.87.120.127.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 25 21:41:07 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 25 21:41:50 ait sshd[1782468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 205.164.235.38
description:
Jan 25 21:42:03 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 205.164.235.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.186
description:
Jan 25 21:42:03 ait sshd[1782659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.254.14
description:
2025-01-25 21:42:00 dovecot_plain authenticator failed for (discephs) [185.254.254.14]:55764: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.186
description:
Jan 25 21:42:03 ait sshd[1782659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.186


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.164.235.38
description:
2025-01-25 21:42:05 dovecot_login authenticator failed for ([205.164.235.34]) [205.164.235.38]:55400: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 25 21:41:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 25 21:41:50 ait sshd[1782468]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.254.14
description:
Jan 25 21:41:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.254.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 25 21:41:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
description:
Jan 25 21:41:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-01-25 21:41:55 dovecot_login authenticator failed for (85.105.241.188.static.ttnet.com.tr) [85.105.241.188]:37626: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-01-25 21:42:49 dovecot_login authenticator failed for ([121.135.188.125]) [121.135.188.125]:49672: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.56.107.53
description:
2025-01-25 21:42:52 dovecot_login authenticator failed for ([191.56.107.53]) [191.56.107.53]:54861: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-25 21:42:57 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-194.tpgi.com.au) [110.175.220.250]:51567: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.137
description:
Jan 25 21:42:29 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 25 21:42:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
description:
Jan 25 21:42:34 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-25 21:42:36 dovecot_login authenticator failed for ([200.149.54.14]) [200.149.54.14]:56854: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Jan 25 21:42:47 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 21:42:18 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
description:
2025-01-25 21:42:36 dovecot_login authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:59635: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.122.253.129
description:
Jan 25 21:42:43 ait sshd[1782970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.253.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 25 21:42:55 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
description:
Jan 25 21:43:08 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.72.149
description:
Jan 25 21:42:22 ait sshd[1782738]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.72.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.137
description:
2025-01-25 21:42:31 dovecot_login authenticator failed for ([119.62.184.137]) [119.62.184.137]:38748: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-01-25 21:42:42 dovecot_login authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:54884: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-01-25 21:42:49 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:53432: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Jan 25 21:42:47 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.56.107.53
description:
Jan 25 21:42:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.56.107.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.72.149
description:
Jan 25 21:42:22 ait sshd[1782738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.72.149


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Jan 25 21:42:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.122.253.129
description:
Jan 25 21:42:43 ait sshd[1782970]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.122.253.129 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.255.91.186
description:
Jan 25 21:43:29 ait sshd[1783278]: Failed password for invalid user user from 185.255.91.186 port 60770 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-25 21:43:34 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:58118: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.214
description:
Jan 25 21:43:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.72.149
description:
Jan 25 21:43:48 ait sshd[1783402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.72.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.72.149
description:
Jan 25 21:43:48 ait sshd[1783402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.72.149


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-01-25 21:43:27 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:49294: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.186
description:
Jan 25 21:43:27 ait sshd[1783278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.186


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
description:
2025-01-25 21:43:10 dovecot_login authenticator failed for ([134.22.116.38]) [134.22.116.38]:42470: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Jan 25 21:43:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.186
description:
Jan 25 21:43:27 ait sshd[1783278]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 21:44:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 25 21:44:47 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 25 21:44:16 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.122.253.129
description:
Jan 25 21:44:16 ait sshd[1783655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.122.253.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.122.253.129
description:
Jan 25 21:44:16 ait sshd[1783655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.253.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-25 21:44:18 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (marvirines) [109.67.154.24]:49236: 535 Incorrect authentication data (set_id=abs61a11144y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.127.226
description:
Jan 25 21:45:32 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.127.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 25 21:45:55 ait sshd[1784531]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 25 21:45:55 ait sshd[1784531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 25 21:45:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 25 21:46:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.127.226
description:
2025-01-25 21:45:34 dovecot_login authenticator failed for ([60.29.127.226]) [60.29.127.226]:54697: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-25 21:46:00 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:53492: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-25 21:46:07 dovecot_plain authenticator failed for (suncic) [77.51.214.170]:54981: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 25 21:46:50 ait sshd[1784922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 25 21:46:50 ait sshd[1784922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.72.149
description:
Jan 25 21:46:35 ait sshd[1784777]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.72.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.72.149
description:
Jan 25 21:46:35 ait sshd[1784777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.72.149


plugin: modsec
rule: 77350296
name: IM360: Block access to the shell
abuser: 204.10.194.167
domain: gvu.titopen.us
description:
IM360: Block access to the shell||MV:/wp-content/plugins/wp-file-upload/xl2024.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 25 21:49:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-25 21:49:35 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (itylle) [94.45.76.149]:50115: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 25 21:50:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-25 21:50:15 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (moidalized) [109.67.154.24]:58808: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.10.43.96
description:
Jan 25 21:52:35 ait sshd[1787487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.10.43.96  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 25 21:56:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
description:
Jan 25 21:55:09 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-01-25 21:55:11 dovecot_plain authenticator failed for (inglats) [185.113.49.23]:43324: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 25 21:55:26 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 21:55:42 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 176.123.3.68
domain: spesrf.ait-ext.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.50.125
description:
Jan 25 21:55:57 ait sshd[1789006]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.50.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.50.125
description:
Jan 25 21:55:57 ait sshd[1789006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.50.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Jan 25 21:56:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 25 21:56:31 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Jan 25 21:56:46 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-01-25 21:56:48 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:38530: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Jan 25 21:56:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-01-25 21:57:00 dovecot_login authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:34111: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 25 21:56:13 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 25 21:57:28 ait sshd[1789617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Jan 25 21:57:50 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-01-25 21:57:52 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:50836: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.113
description:
Jan 25 21:57:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
description:
2025-01-25 21:58:00 dovecot_plain authenticator failed for ([130.185.96.113]) [130.185.96.113]:37640: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 25 21:58:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 25 21:57:28 ait sshd[1789617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 192.166.246.245
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:21-57.192.166.246.245


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 176.123.3.68
domain: spesrf.ait-ext.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:EmailWolf 1.00||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-25 21:59:02 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (avellits) [109.67.154.24]:45096: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
description:
Jan 25 21:59:05 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
description:
2025-01-25 21:59:07 dovecot_login authenticator failed for ([183.220.247.88]) [183.220.247.88]:47854: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 25 21:59:00 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-25 21:59:26 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:44502: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Jan 25 21:59:35 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Jan 25 21:59:40 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-01-25 21:59:42 dovecot_login authenticator failed for ([171.217.70.151]) [171.217.70.151]:60760: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.171.226
description:
Jan 25 21:59:56 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.171.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-25 22:00:00 dovecot_login authenticator failed for ([36.134.78.151]) [36.134.78.151]:58249: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
description:
Jan 25 22:00:03 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
description:
2025-01-25 22:00:05 dovecot_login authenticator failed for mail.toptronicsinc.com [218.4.156.254]:47245: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 25 21:59:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-25 21:59:17 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:15384: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 25 21:59:24 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-01-25 21:59:37 dovecot_plain authenticator failed for (unhastic) [89.175.253.49]:43338: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.248.70
description:
2025-01-25 21:59:38 dovecot_login authenticator failed for p173071-obmd01.osaka.ocn.ne.jp [61.118.248.70]:44083: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.121.214.105
description:
Jan 25 21:59:38 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.121.214.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.78
description:
2025-01-25 21:59:55 dovecot_plain authenticator failed for (dezated) [65.20.162.78]:53640: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 25 21:59:58 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.57.60
description:
Jan 25 21:59:25 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.57.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.12.36
description:
Jan 25 21:59:30 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.12.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.12.36
description:
2025-01-25 21:59:32 dovecot_login authenticator failed for ([210.21.12.36]) [210.21.12.36]:57908: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.118.248.70
description:
Jan 25 21:59:36 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.118.248.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
description:
2025-01-25 21:59:27 dovecot_login authenticator failed for ([85.152.57.60]) [85.152.57.60]:38745: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.121.214.105
description:
2025-01-25 21:59:40 dovecot_login authenticator failed for ([176.121.214.105]) [176.121.214.105]:60497: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.78
description:
Jan 25 21:59:53 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
description:
2025-01-25 21:59:58 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:43195: 535 Incorrect authentication data (set_id=eng20a00103y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 25 22:00:20 ait sshd[1791031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.215
description:
Jan 25 22:00:33 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.215
description:
2025-01-25 22:00:35 dovecot_login authenticator failed for ([195.178.110.215]) [195.178.110.215]:57701: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-01-25 22:00:38 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:46478: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 25 22:00:16 ait sshd[1790924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-25 22:00:17 dovecot_plain authenticator failed for (tizei) [149.0.19.108]:44218: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 25 22:00:15 ait auth[1328166]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 25 22:00:16 ait sshd[1790924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


