# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.225.246.33
country_id: 1282988
description:
103.225.246.33 - - [14/Jun/2026:06:49:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078826&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F12%252F30%252Ftogo-rapprocher-le-droit-du-citoyen-et-inversement-une-ambition-qui-prend-corps%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781419745 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/12/30/togo-rapprocher-le-droit-du-citoyen-et-inversement-une-ambition-qui-prend-corps/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.1577.1560 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.225.246.33


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.46.12
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/4E_YoyYgandA_Wk5IEwi-O.webp 640w, http:/togodailynews.tg/wp-content/uploads/2026/05/4E_YoyYgandA_Wk5IEwi-O-300x216.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 06:51:05 ns5.netmaster.tg cpanel_fileman_hook[3063675]: 0 BAILOUT malware detected when save 'index.php' in /home/edjatiapougloe/public_html/contact-us for user edjatiapougloe


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 06:50:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 06:50:21 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61195: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 06:51:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 06:53:55 ns5.netmaster.tg cpanel_fileman_hook[3065074]: 0 BAILOUT malware detected when save 'index.php' in /home/edjatiapougloe/public_html/our-team for user edjatiapougloe


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [14/Jun/2026:06:53:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881753&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecurite-sanitaire-des-eleves-les-jardins-scolaires-une-solution-ideale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781420003 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/securite-sanitaire-des-eleves-les-jardins-scolaires-une-solution-ideale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.75
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/css/style.css HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.216
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/js/theme.js HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.107.34
country_id: 3175395
description:
Jun 14 06:55:54 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.107.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.206.235.47
country_id: 1814991
description:
140.206.235.47 - - [14/Jun/2026:06:56:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444077&pdata=https%253A%252F%252Flaunetogo.tg%252Fcategory%252Fsociete%252Fpage%252F103%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781420158 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/category/societe/page/103/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.206.235.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-06-14 06:56:09 dovecot_login authenticator failed for H=([119.198.191.180]) [136.56.34.147]:51272: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.89.90
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.56.34.147
country_id: 6252001
description:
Jun 14 06:56:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.56.34.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.67.29
country_id: 6252001
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.64
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/css/plugins.css HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.29.100
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.28.225
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/js/plugins.js HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 14 06:57:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.110.138
country_id: 1269750
description:
Jun 14 06:59:06 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.110.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.138
country_id: 1269750
description:
2026-06-14 06:59:08 dovecot_login authenticator failed for H=(nsg-corporate-225.174.185.122.airtel.in) [182.95.110.138]:42096: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.84.86
country_id: 3469034
description:
Jun 14 07:00:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.84.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.84.86
country_id: 3469034
description:
2026-06-14 07:00:50 dovecot_login authenticator failed for H=(90-230-115-5-no2550.tbcn.telia.com) [187.51.84.86]:41178: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.84.245.170
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/33343305 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.68
country_id: 1814991
description:
2026-06-14 07:03:59 dovecot_login authenticator failed for H=(dsl-94-233-127-194.avtlg.ru) [27.39.128.68]:58024: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.241.228.34
country_id: 1269750
description:
Jun 14 07:04:14 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.241.228.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.39.128.68
country_id: 1814991
description:
Jun 14 07:03:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.39.128.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.238.182
country_id: 719819
description:
2026-06-14 07:03:41 dovecot_plain authenticator failed for H=([127.0.0.1]) [91.219.238.182]:53584: 535 Incorrect authentication data (set_id=admin@bethanymitchell.co.uk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 07:05:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61669: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 07:04:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jun 14 07:05:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.123.115.10
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-scaled.jpeg 2560w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-300x169.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-1024x576.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-768x432.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-1536x864.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-2048x1152.jpeg 2048w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 07:07:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: yoto2.mairie.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"$83f285d4\":\"cead\",\"status\":\"resolved_model\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var esxd=[].slice.call(arguments,1)[0];var gzq=esxd;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 14 07:10:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 204.188.233.66
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47098.kpmg.tg||ServerName:kpmg.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:914a1dfd26e6d57d4cbf6ff096abacbeb03d4d4f||Title:0x1dca1038||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 14 07:13:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-14 07:13:22 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:33154: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 14 07:13:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.84.86
country_id: 3469034
description:
Jun 14 07:15:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.84.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.84.86
country_id: 3469034
description:
2026-06-14 07:15:29 dovecot_login authenticator failed for H=([49.124.153.15]) [187.51.84.86]:34129: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.239.184
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1.webp 1600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [14/Jun/2026:07:17:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7496345&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurent-gbagbo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781421448 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurent-gbagbo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 85.192.28.47
country_id: 2921044
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-17.85.192.28.47||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 14 07:24:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.242.230.113
country_id: 3017382
description:
[2026-06-14 07:33:12 +0000] info [cpaneld] 38.242.230.113 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:33:18 +0000] info [whostmgrd] 114.79.0.6 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:33:15 +0000] info [whostmgrd] 114.79.0.6 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:33:19 +0000] info [whostmgrd] 114.79.0.6 - root "GET /cpsess2707680818/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.2
country_id: 6252001
description:
205.169.39.2 - - [14/Jun/2026:07:34:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146569&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781422457 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.2


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.26.14
country_id: 3865483
domain: cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tghttp/cloud-et-racks.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19424: 535 Incorrect authentication data (set_id=testis@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.26.14
country_id: 3865483
domain: cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:36:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44866: 535 Incorrect authentication data (set_id=I've@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:36:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11054: 535 Incorrect authentication data (set_id=mart@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:36:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:36:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:37:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31250: 535 Incorrect authentication data (set_id=verkoop@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:37:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33842: 535 Incorrect authentication data (set_id=augustin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:37:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:37:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5844: 535 Incorrect authentication data (set_id=wix@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:37:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:37:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:38:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63346: 535 Incorrect authentication data (set_id=ljenkins@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 14 07:38:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:38:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:38:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49966: 535 Incorrect authentication data (set_id=zcs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:38:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25452: 535 Incorrect authentication data (set_id=tmc@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:38:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34370: 535 Incorrect authentication data (set_id=nutrition@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:38:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:38:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:39:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41386: 535 Incorrect authentication data (set_id=yamada@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:39:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:39:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30244: 535 Incorrect authentication data (set_id=inno@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:39:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53904: 535 Incorrect authentication data (set_id=vendeg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:39:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:39:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:40:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:40:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32798: 535 Incorrect authentication data (set_id=kopeikin@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:40:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42642: 535 Incorrect authentication data (set_id=hirschmann@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:40:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46820: 535 Incorrect authentication data (set_id=nevada@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:40:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:40:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21738: 535 Incorrect authentication data (set_id=crescent@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:41:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13384: 535 Incorrect authentication data (set_id=changeme2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:41:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:41:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:41:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38512: 535 Incorrect authentication data (set_id=harrison1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:41:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:41:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24142: 535 Incorrect authentication data (set_id=hebe@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:42:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62430: 535 Incorrect authentication data (set_id=cvsup@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:42:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:42:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30376: 535 Incorrect authentication data (set_id=referral@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 14 07:43:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:42:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:43:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48604: 535 Incorrect authentication data (set_id=jmartinez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:42:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4648: 535 Incorrect authentication data (set_id=torrents@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:43:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21012: 535 Incorrect authentication data (set_id=palm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:43:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:43:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53888: 535 Incorrect authentication data (set_id=jmartinez@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:43:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:43:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60598: 535 Incorrect authentication data (set_id=architecture@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:43:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:44:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45356: 535 Incorrect authentication data (set_id=anouk@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:44:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:44:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14162: 535 Incorrect authentication data (set_id=sicurezza@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:44:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20430: 535 Incorrect authentication data (set_id=backuppc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:44:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 14 07:45:06 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:44:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:45:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:45:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:6040: 535 Incorrect authentication data (set_id=smarthost@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:45:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:45:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43724: 535 Incorrect authentication data (set_id=jp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:45:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:45:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36942: 535 Incorrect authentication data (set_id=tonya@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:45:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12046: 535 Incorrect authentication data (set_id=dag@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:46:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:46:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19590: 535 Incorrect authentication data (set_id=recreation@ns5.netmaster.tg)


plugin: modsec
rule: 77065534
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html lang=\"en-GB\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"TTP\")</script>\n<meta charset=\"utf-8\">\n<title>MAS77TOTO:Slot Gacor Terbaik 2026 Situs Link Geme Online Gampang Maxin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/mas77toto/repair-welding.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/service/repair-welding/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"MAS77TOTO merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. Dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, MAS77TOTO dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\">\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n<meta http-equiv=\"content-language\" content=\"en-ID\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"MAS77TOTO\">\n<meta name=\"author\" content=\"MAS77TOTO\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"MAS77TOTO\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhZrk-AdJ47e9IJVdmcu4hbuTQxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jN5WV4yGC6bv-Y8gTz1rwqhWHeiQ:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@Situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"MAS77TOTO:Slot Gacor Terbaik 2026 Situs Link Geme Online Gampang Maxin\" />\n<meta property=\"og:description\" content=\" MAS77TOTO merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. Dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, MAS77TOTO dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/service/repair-welding/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"USD\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"Etsy\" /><meta name=\"application-name\" content=\"Etsy\" /><meta name=\"msapplication-TileColor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-FI\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-AU\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-DK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-HK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-IE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-IL\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-IN\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-NZ\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-NO\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-SE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-SG\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-GB\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-AT\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-CH\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl-BE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es-MX\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-US\" />\n<script nonce=\"gPiNOjdRCrWLas5Ik2CuS+N0\">\n    !function(e){var r=e.__etsy_logging={};r.errorQueue=[],e.onerror=function(e,o,t,n,s){r.errorQueue.push([e,o,t,n,s])},r.firedEvents=[];r.perf={e:[],t:!1,MARK_MEASURE_PREFIX:\"_etsy_mark_measure_\",prefixMarkMeasure:function(e){return\"_etsy_mark_measure_\"+e}},e.PerformanceObserver&&(r.perf.o=new PerformanceObserver((function(e){r.perf.e=r.perf.e.concat(e.getEntries())})),r.perf.o.observe({entryTypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Possible XSS in arguments||MV:\n\n\n\n\n\n\n\n<!doctype html>\n<html lang=\"en-gb\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"ttp\")</script>\n<meta charset=\"utf-8\">\n<title>mas77toto:slot gacor terbaik 2026 situs link geme online gampang maxin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/mas77toto/repair-welding.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/service/repair-welding/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"mas77toto merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, mas77toto dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\">\n<meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\n<meta http-equiv=\"content-language\" content=\"en-id\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"mas77toto\">\n<meta name=\"author\" content=\"mas77toto\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"mas77toto\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhzrk-adj47e9ijvdmcu4hbutqxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jn5wv4ygc6bv-y8gtz1rwqhwheiq:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"mas77toto:slot gacor terbaik 2026 situs link geme online gampang maxin\" />\n<meta property=\"og:description\" content=\" mas77toto merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, mas77toto dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/service/repair-welding/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"usd\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"etsy\" /><meta name=\"application-name\" content=\"etsy\" /><meta name=\"msapplication-tilecolor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-fi\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-au\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-dk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-hk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-ie\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-il\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-in\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-nz\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-no\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-se\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-sg\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-gb\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-at\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-ch\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl-be\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es-mx\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-us\" />\n<script nonce=\"gpinojdrcrwlas5ik2cus n0\">\n    !function(e){var r=e.__etsy_logging={};r.errorqueue=[],e.onerror=function(e,o,t,n,s){r.errorqueue.push([e,o,t,n,s])},r.firedevents=[];r.perf={e:[],t:!1,mark_measure_prefix:\"_etsy_mark_measure_\",prefixmarkmeasure:function(e){return\"_etsy_mark_measure_\" e}},e.performanceobserver&&(r.perf.o=new performanceobserver((function(e){r.perf.e=r.perf.e.concat(e.getentries())})),r.perf.o.observe({entrytypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:46:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26452: 535 Incorrect authentication data (set_id=perkins@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:46:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:46:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:46:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23036: 535 Incorrect authentication data (set_id=notification@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18084: 535 Incorrect authentication data (set_id=lst@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:47:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11328: 535 Incorrect authentication data (set_id=ens@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:47:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:47:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:47:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52750: 535 Incorrect authentication data (set_id=ens@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:48:01 +0000] info [whostmgrd] 114.79.0.6 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:47:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14390: 535 Incorrect authentication data (set_id=scan@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:48:04 +0000] info [whostmgrd] 114.79.0.6 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:48:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:48:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:48:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9686: 535 Incorrect authentication data (set_id=ocruz@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:48:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11086: 535 Incorrect authentication data (set_id=tetris@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 07:48:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:59006: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.11.115
country_id: 1668284
description:
2026-06-14 07:49:15 dovecot_login authenticator failed for H=116-59-11-115.emome-ip.hinet.net (203-222-135-138.tpgi.com.au) [116.59.11.115]:57840: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 07:48:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:48:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:48:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48558: 535 Incorrect authentication data (set_id=snmp@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:50:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62532: 535 Incorrect authentication data (set_id=office2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:49:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:49:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14430: 535 Incorrect authentication data (set_id=isdn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:49:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61592: 535 Incorrect authentication data (set_id=salmo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:49:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40266: 535 Incorrect authentication data (set_id=wyl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:49:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:49:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:50:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:50:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:31928: 535 Incorrect authentication data (set_id=aqq123@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.81.177.139
country_id: 2510769
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/05/JIT-2025-a-la-Presidence-de-la-Republique-un-vibrant-hommage-au-chef-de-lEtat-pour-son-engagement-pour-le-bien-etre-des-travailleurs.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/05/JIT-2025-a-la-Presidence-de-la-Republique-un-vibrant-hommage-au-chef-de-lEtat-pour-son-engagement-pour-le-bien-etre-des-travailleurs-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/05/JIT-2025-a-la-Presidence-de-la-Republique-un-vibrant-hommage-au-chef-de-lEtat-pour-son-engagement-pour-le-bien-etre-des-travailleurs-768x512.webp 768w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:50:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15740: 535 Incorrect authentication data (set_id=office2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6106: 535 Incorrect authentication data (set_id=casper@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:50:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:50:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:51:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:51:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6938: 535 Incorrect authentication data (set_id=sdc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:51:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24852: 535 Incorrect authentication data (set_id=slike@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:51:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62348: 535 Incorrect authentication data (set_id=hunter@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:51:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54100: 535 Incorrect authentication data (set_id=aec@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:52:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:52:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41022: 535 Incorrect authentication data (set_id=aec@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:52:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62870: 535 Incorrect authentication data (set_id=sobranie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:52:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:52:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16406: 535 Incorrect authentication data (set_id=redesign@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:52:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:53:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14160: 535 Incorrect authentication data (set_id=adminweb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:53:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:53:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:53:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54356: 535 Incorrect authentication data (set_id=pru@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:53:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7890: 535 Incorrect authentication data (set_id=dp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:53:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:54:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23638: 535 Incorrect authentication data (set_id=barra@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:54:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:5896: 535 Incorrect authentication data (set_id=tafaras@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:54:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:54:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:54:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45662: 535 Incorrect authentication data (set_id=lp2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:54:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:54:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62874: 535 Incorrect authentication data (set_id=d@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:55:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:55:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37080: 535 Incorrect authentication data (set_id=kv@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.42.242.9
country_id: 1643084
description:
[2026-06-14 07:56:01 +0000] info [cpaneld] 103.42.242.9 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:55:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62072: 535 Incorrect authentication data (set_id=centreon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:55:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54632: 535 Incorrect authentication data (set_id=edit@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:55:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:55:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:56:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:56:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:56:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53772: 535 Incorrect authentication data (set_id=dabrowska@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:56:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28442: 535 Incorrect authentication data (set_id=oma@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:56:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47564: 535 Incorrect authentication data (set_id=idid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:56:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:56:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49620: 535 Incorrect authentication data (set_id=win10@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:57:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.235.78.191
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg-225x300.webp 225w, http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg-768x1024.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg.webp 960w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:57:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:57:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19856: 535 Incorrect authentication data (set_id=bitcoin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:57:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3768: 535 Incorrect authentication data (set_id=daphne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:57:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61098: 535 Incorrect authentication data (set_id=esco@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:57:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:58:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52904: 535 Incorrect authentication data (set_id=todd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:58:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11260: 535 Incorrect authentication data (set_id=conges@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:58:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:59:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49362: 535 Incorrect authentication data (set_id=kalender@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:58:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:58:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59926: 535 Incorrect authentication data (set_id=spam123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:58:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:59:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64490: 535 Incorrect authentication data (set_id=uk@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:59:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:59:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:59:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2574: 535 Incorrect authentication data (set_id=kalender@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:59:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:59:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26948: 535 Incorrect authentication data (set_id=narendra@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:00:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:00:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:00:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55866: 535 Incorrect authentication data (set_id=indian@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:00:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17456: 535 Incorrect authentication data (set_id=contabilidade@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:00:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:00:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58522: 535 Incorrect authentication data (set_id=jga@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:01:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:01:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32272: 535 Incorrect authentication data (set_id=tototo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:01:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47326: 535 Incorrect authentication data (set_id=veriato@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:01:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:01:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:01:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9126: 535 Incorrect authentication data (set_id=hongmeng@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:01:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10358: 535 Incorrect authentication data (set_id=hongmeng@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:02:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:02:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7058: 535 Incorrect authentication data (set_id=primavera@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:02:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:02:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2196: 535 Incorrect authentication data (set_id=mexal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:02:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 08:02:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:02:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18630: 535 Incorrect authentication data (set_id=wangzheng@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 08:02:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55812: 535 Incorrect authentication data (set_id=testuser1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:03:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58424: 535 Incorrect authentication data (set_id=jomama@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:03:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62936: 535 Incorrect authentication data (set_id=sammy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:03:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:03:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:03:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:03:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10166: 535 Incorrect authentication data (set_id=paseo@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:03:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16990: 535 Incorrect authentication data (set_id=kamei1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:04:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:04:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:04:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54442: 535 Incorrect authentication data (set_id=hilde@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:04:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50016: 535 Incorrect authentication data (set_id=aleksandr@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:04:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:04:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1402: 535 Incorrect authentication data (set_id=wildcat@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.158.216
country_id: 1835841
description:
Jun 14 08:04:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.158.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.158.216
country_id: 1835841
description:
2026-06-14 08:04:46 dovecot_login authenticator failed for H=([49.125.203.167]) [211.221.158.216]:37961: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:05:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17390: 535 Incorrect authentication data (set_id=abderian@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:05:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:06:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27512: 535 Incorrect authentication data (set_id=gumby@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:05:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:06:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21160: 535 Incorrect authentication data (set_id=wegener@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:05:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:05:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41484: 535 Incorrect authentication data (set_id=freeman@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:06:10 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:05:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:05:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37290: 535 Incorrect authentication data (set_id=sawaguchi@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:05:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52808: 535 Incorrect authentication data (set_id=mary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:05:58 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:05:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20034: 535 Incorrect authentication data (set_id=arquitectura@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:06:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:06:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55736: 535 Incorrect authentication data (set_id=srvc12@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:06:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33048: 535 Incorrect authentication data (set_id=nishi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:06:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:06:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21652: 535 Incorrect authentication data (set_id=cavalrydesign@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:06:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11160: 535 Incorrect authentication data (set_id=mary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:06:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:06:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:06:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:06:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60490: 535 Incorrect authentication data (set_id=ssmtp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:06:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23398: 535 Incorrect authentication data (set_id=kepegawaian@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:07:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:07:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2554: 535 Incorrect authentication data (set_id=ray@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:07:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:07:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:07:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:07:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46842: 535 Incorrect authentication data (set_id=hrm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:07:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [14/Jun/2026:08:07:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185620&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbayern-munich%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781424460 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bayern-munich/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:07:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:65252: 535 Incorrect authentication data (set_id=trac@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:07:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:07:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46548: 535 Incorrect authentication data (set_id=btb@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:08:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19440: 535 Incorrect authentication data (set_id=prez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8772: 535 Incorrect authentication data (set_id=908@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:07:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24868: 535 Incorrect authentication data (set_id=externe@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:08:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:08:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:08:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:08:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:08:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:08:38 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:08:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15260: 535 Incorrect authentication data (set_id=okamoto@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:08:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56856: 535 Incorrect authentication data (set_id=citrix@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58490: 535 Incorrect authentication data (set_id=pbx@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5152: 535 Incorrect authentication data (set_id=yo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:08:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13186: 535 Incorrect authentication data (set_id=snezana@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38338: 535 Incorrect authentication data (set_id=libraries@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:09:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:09:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:09:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:09:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.93.117
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.111.93.117||TA:142.111.93.117||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:09:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49838: 535 Incorrect authentication data (set_id=deidre@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:09:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4226: 535 Incorrect authentication data (set_id=m01@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:09:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30062: 535 Incorrect authentication data (set_id=melina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61498: 535 Incorrect authentication data (set_id=dks@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:09:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:09:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16784: 535 Incorrect authentication data (set_id=sweet@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:09:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48584: 535 Incorrect authentication data (set_id=es-nexus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:09:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:10:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59772: 535 Incorrect authentication data (set_id=training1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:10:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2728: 535 Incorrect authentication data (set_id="?g@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53466: 535 Incorrect authentication data (set_id=vpntest1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:10:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:10:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8556: 535 Incorrect authentication data (set_id=web2f1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:10:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:10:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40344: 535 Incorrect authentication data (set_id=textile@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:10:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:10:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:10:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:10:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41332: 535 Incorrect authentication data (set_id=sterling@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:10:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44600: 535 Incorrect authentication data (set_id=vpntest1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:11:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60282: 535 Incorrect authentication data (set_id=trophy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:11:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31896: 535 Incorrect authentication data (set_id=krang@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:11:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:11:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:11:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50802: 535 Incorrect authentication data (set_id=dev-app@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:11:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45336: 535 Incorrect authentication data (set_id=parameter@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.254.214
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:191.96.254.214||TA:191.96.254.214||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:11:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:11:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:11:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50644: 535 Incorrect authentication data (set_id=bergen-gw2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:11:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32726: 535 Incorrect authentication data (set_id=casting@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:11:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:11:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:12:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52042: 535 Incorrect authentication data (set_id=regis@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:12:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56344: 535 Incorrect authentication data (set_id=invites@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:12:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:12:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37158: 535 Incorrect authentication data (set_id=www17@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:12:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:12:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56610: 535 Incorrect authentication data (set_id=limin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:12:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:12:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24082: 535 Incorrect authentication data (set_id=db7@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:12:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1558: 535 Incorrect authentication data (set_id=fr@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:12:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:12:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:12:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42638: 535 Incorrect authentication data (set_id=limin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:13:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:13:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:13:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6204: 535 Incorrect authentication data (set_id=backup3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:13:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34360: 535 Incorrect authentication data (set_id=ziad@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:13:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:13:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29006: 535 Incorrect authentication data (set_id=inbound@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:13:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56788: 535 Incorrect authentication data (set_id=camille@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:13:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62252: 535 Incorrect authentication data (set_id=inter2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:13:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:13:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42592: 535 Incorrect authentication data (set_id=toshiba@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:13:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:13:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:14:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:14:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:14:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [14/Jun/2026:08:14:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067095&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fguillaume-soro%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781424886 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/guillaume-soro/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62342: 535 Incorrect authentication data (set_id=mysql@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:14:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:14:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47408: 535 Incorrect authentication data (set_id=gbo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:14:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20336: 535 Incorrect authentication data (set_id=cinema@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26110: 535 Incorrect authentication data (set_id=test100@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35488: 535 Incorrect authentication data (set_id=filo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:14:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:14:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7152: 535 Incorrect authentication data (set_id=marcos@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:14:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22510: 535 Incorrect authentication data (set_id=gbo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:15:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:15:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:15:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13200: 535 Incorrect authentication data (set_id=revokeall@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:15:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:15:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17852: 535 Incorrect authentication data (set_id=rck@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45282: 535 Incorrect authentication data (set_id=toussaint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:15:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27176: 535 Incorrect authentication data (set_id=tf@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:15:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:15:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:15:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12220: 535 Incorrect authentication data (set_id=zxc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:15:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53892: 535 Incorrect authentication data (set_id=protocollo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:15:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:16:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:16:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9508: 535 Incorrect authentication data (set_id=regine@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:16:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60274: 535 Incorrect authentication data (set_id=toney@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:16:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.179.17
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.179.17||TA:148.135.179.17||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:16:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4130: 535 Incorrect authentication data (set_id=project2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:16:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:16:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28770: 535 Incorrect authentication data (set_id=wq@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:17:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56132: 535 Incorrect authentication data (set_id=webmail3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:17:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:17:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19616: 535 Incorrect authentication data (set_id=ftpbackup@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.43.225
country_id: 6251999
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.43.225||TA:104.239.43.225||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:17:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:17:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1310: 535 Incorrect authentication data (set_id=alena@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:17:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:18:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:18:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:18:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:19:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16004: 535 Incorrect authentication data (set_id=sokolova@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:18:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47906: 535 Incorrect authentication data (set_id=qwerty1234@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:18:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57532: 535 Incorrect authentication data (set_id=diego@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:18:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10278: 535 Incorrect authentication data (set_id=test16@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.81.247
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.81.247||TA:104.239.81.247||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:19:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:19:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39544: 535 Incorrect authentication data (set_id=tosho@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:19:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1636: 535 Incorrect authentication data (set_id=mercator@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:19:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:19:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:19:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11854: 535 Incorrect authentication data (set_id=spqr@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.167.92
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.117.167.92||TA:217.117.167.92||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30652: 535 Incorrect authentication data (set_id=carrie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:20:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:20:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40812: 535 Incorrect authentication data (set_id=krzysiek@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:20:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39110: 535 Incorrect authentication data (set_id=oshima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.148
country_id: 3469034
description:
Jun 14 08:20:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:20:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:20:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.180.84
country_id: 3469034
description:
Jun 14 08:20:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.124.62
country_id: 226074
description:
2026-06-14 08:20:47 dovecot_login authenticator failed for H=(196.0.124.62) [196.0.124.62]:39833: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.244.44
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.245.244.44||TA:104.245.244.44||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28596: 535 Incorrect authentication data (set_id=yoshioka@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:21:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:21:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32282: 535 Incorrect authentication data (set_id=invoices@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:21:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.119.133
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.119.133||TA:198.105.119.133||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:21:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21780: 535 Incorrect authentication data (set_id=0961@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.38.157
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.38.157||TA:104.238.38.157||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.205.24
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:151.245.205.24||TA:151.245.205.24||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:21:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:21:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30684: 535 Incorrect authentication data (set_id=yoshioka@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:22:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.164.41
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.117.164.41||TA:217.117.164.41||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12670: 535 Incorrect authentication data (set_id=iwan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:22:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.219.199
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.219.199||TA:104.253.219.199||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.95.231
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.95.231||TA:152.232.95.231||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:22:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20028: 535 Incorrect authentication data (set_id=megarim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:22:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37650: 535 Incorrect authentication data (set_id=yem@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:22:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:23:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11534: 535 Incorrect authentication data (set_id=new@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.12.151
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.233.12.151||TA:104.233.12.151||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:23:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:23:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3524: 535 Incorrect authentication data (set_id=backup4@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7664: 535 Incorrect authentication data (set_id=backup4@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:23:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:23:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15338: 535 Incorrect authentication data (set_id=sadhbh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:24:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:24:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:24:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2942: 535 Incorrect authentication data (set_id=garlic@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:24:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58796: 535 Incorrect authentication data (set_id=abba@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:24:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6938: 535 Incorrect authentication data (set_id=fabrizio@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:25:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63050: 535 Incorrect authentication data (set_id=sultan@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:25:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12490: 535 Incorrect authentication data (set_id=sultan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:25:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58908: 535 Incorrect authentication data (set_id=nevada@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:25:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:25:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49690: 535 Incorrect authentication data (set_id=sptest@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:25:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:25:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:26:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49570: 535 Incorrect authentication data (set_id=misc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:26:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:26:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:26:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:26:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10692: 535 Incorrect authentication data (set_id=mijn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:26:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8268: 535 Incorrect authentication data (set_id=pace@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:27:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:40994: 535 Incorrect authentication data (set_id=isk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:27:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13208: 535 Incorrect authentication data (set_id=controllo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:27:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:27:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:28:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28044: 535 Incorrect authentication data (set_id=miracle@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:27:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.156
country_id: 3175395
description:
Jun 14 08:27:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:27:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41322: 535 Incorrect authentication data (set_id=catalina@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.187.76
country_id: 6251999
domain: davetechno.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/davetechno.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:28:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65450: 535 Incorrect authentication data (set_id=deneme@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:28:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32846: 535 Incorrect authentication data (set_id=capital1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:28:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:28:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.188.247
country_id: 6251999
domain: www.davetechno.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.davetechno.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:28:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57282: 535 Incorrect authentication data (set_id=tsuchiya@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:28:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:29:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:30:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20656: 535 Incorrect authentication data (set_id=nfuentes@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:29:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:29:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:29:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61356: 535 Incorrect authentication data (set_id=alain@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-06-14 08:29:27 dovecot_login authenticator failed for H=(n51-h64.smr-rsk.metromax.ru) [36.42.67.114]:54402: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.239.219.150
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.239.219.150||TA:173.239.219.150||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:29:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24632: 535 Incorrect authentication data (set_id=dima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.42.67.114
country_id: 1814991
description:
Jun 14 08:29:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.42.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:29:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48072: 535 Incorrect authentication data (set_id=u15@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:30:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38952: 535 Incorrect authentication data (set_id=franchesca@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.15.179.172
country_id: 3895114
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.15.179.172||TA:185.15.179.172||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:30:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:30:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53114: 535 Incorrect authentication data (set_id=u@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16412: 535 Incorrect authentication data (set_id=pet@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.56
country_id: 2077456
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:202.155.186.56||TA:202.155.186.56||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:30:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:30:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:31:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17704: 535 Incorrect authentication data (set_id=svn1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:31:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:31:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:31:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29680: 535 Incorrect authentication data (set_id=ibanking@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:31:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:31:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8122: 535 Incorrect authentication data (set_id=dbrown@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:32:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:32:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9514: 535 Incorrect authentication data (set_id=karim@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:32:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23476: 535 Incorrect authentication data (set_id=karim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:32:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:32:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64394: 535 Incorrect authentication data (set_id=autoconfig@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.104.161.184
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/Conseil-des-ministres-du-1er-avril-2026-768x614.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/Conseil-des-ministres-du-1er-avril-2026-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/Conseil-des-ministres-du-1er-avril-2026.webp 800w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:32:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:32:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20520: 535 Incorrect authentication data (set_id=w11@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.143.37.9
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/9809ee919700b462ba2323b5076cbe67_L.webp 500w, http:/togodailynews.tg/wp-content/uploads/2026/05/9809ee919700b462ba2323b5076cbe67_L-300x200.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:33:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:33:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:33:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1416: 535 Incorrect authentication data (set_id=fsa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:33:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56096: 535 Incorrect authentication data (set_id=mirko@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:33:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11296: 535 Incorrect authentication data (set_id=activation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47336: 535 Incorrect authentication data (set_id=\343\202\271\343\203\221\343\203\240@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57806: 535 Incorrect authentication data (set_id=advert@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:34:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41702: 535 Incorrect authentication data (set_id=users@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:34:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:34:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:34:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2084: 535 Incorrect authentication data (set_id=users@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:34:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57442: 535 Incorrect authentication data (set_id=surgeon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:35:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49624: 535 Incorrect authentication data (set_id=etu@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.70.31.153
country_id: 2077456
description:
212.70.31.153 - - [14/Jun/2026:08:35:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145492&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fmission-123-action-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426151 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/mission-123-action-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.3459.1015 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.70.31.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:35:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34690: 535 Incorrect authentication data (set_id=excursion@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:35:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:35:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:35:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 129.226.174.80
country_id: 1819730
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.75.81
country_id: 1835841
description:
Jun 14 08:37:10 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.75.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 173.239.198.117
country_id: 6252001
domain: www.tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.7
country_id: 798544
description:
Jun 14 08:39:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.60
country_id: 3469034
description:
Jun 14 08:39:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.36.61
country_id: 1643084
description:
[2026-06-14 08:41:12 +0000] info [cpaneld] 182.9.36.61 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [14/Jun/2026:08:40:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380959&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-chauffeurs-otr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426458 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-chauffeurs-otr/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.32.68.31
country_id: 6252001
domain: in.crepsad.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/crepsad/in.crepsad.tg/wp-content/uploads||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.37.112
country_id: 3895114
description:
[2026-06-14 08:41:15 +0000] info [cpaneld] 190.114.37.112 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.166.246
country_id: 3469034
description:
[2026-06-14 08:41:18 +0000] info [cpaneld] 45.229.166.246 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.216.160
country_id: 3895114
description:
[2026-06-14 08:41:27 +0000] info [cpaneld] 181.43.216.160 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.172.103.20
country_id: 2017370
description:
[2026-06-14 08:41:21 +0000] info [cpaneld] 85.172.103.20 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.41.185.24
country_id: 2017370
description:
[2026-06-14 08:41:24 +0000] info [cpaneld] 94.41.185.24 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-42.146.103.121.241||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: ticket.cafe.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [14/Jun/2026:08:46:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10079083&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-usp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426788 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-usp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-46.146.103.121.241||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 40.192.118.81
country_id: 1269750
description:
2026-06-14 08:48:29 dovecot_plain authenticator failed for H=ec2-40-192-118-81.ap-south-2.compute.amazonaws.com (ot2aoaw3publka3usbzc4j3sf) [40.192.118.81]:52216: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.209.95.13
country_id: 3865483
description:
181.209.95.13 - - [14/Jun/2026:08:48:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265818&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F02%252F21%252Faux-hommes-3-bonnes-raisons-de-ne-pas-retourner-avec-votre-ex-meme-si-elle-a%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426905 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/02/21/aux-hommes-3-bonnes-raisons-de-ne-pas-retourner-avec-votre-ex-meme-si-elle-a/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.3502.1053 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.209.95.13


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 167.179.40.169
country_id: 1831722
description:
[2026-06-14 08:50:31 +0000] info [cpaneld] 167.179.40.169 NEW edjatiapougloe:e9qhVw9gex7ESbux address=167.179.40.169,app=cpaneld,creator=edjatiapougloe,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.208.122
country_id: 933860
description:
Jun 14 08:52:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.208.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 14 08:59:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 14 08:59:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.26
country_id: 226074
description:
Jun 14 08:59:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 14 09:04:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-06-14 09:04:22 dovecot_plain authenticator failed for H=(coser) [65.20.149.93]:40703: 535 Incorrect authentication data (set_id=hr@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 156.38.82.173
country_id: 2363686
description:
156.38.82.173 - - [14/Jun/2026:09:06:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9658780&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F12%252Ffait-divers-le-drame-du-poulet-bicyclette%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781427981 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/12/fait-divers-le-drame-du-poulet-bicyclette/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.38.82.173


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-14 09:10:20 dovecot_login authenticator failed for H=(nsg-corporate-193.168.185.122.airtel.in) [27.71.21.70]:5961: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.211.39.86
country_id: 1814991
description:
Jun 14 09:18:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.211.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.211.39.86
country_id: 1814991
description:
2026-06-14 09:18:37 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [58.211.39.86]:40146: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 14 09:20:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.107
country_id: 99237
description:
Jun 14 09:19:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 14 09:20:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [14/Jun/2026:09:28:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593388&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781429322 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.119.1
country_id: 1880251
domain: butodra.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.243.240.81
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-31.196.243.240.81||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.243.240.81
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:196.243.240.81||TA:196.243.240.81||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-14 09:32:46 +0000] info [cpaneld] 103.77.107.71 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.64
country_id: 2963597
description:
Jun 14 09:33:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.85.146.216
country_id: 6252001
description:
Jun 14 09:34:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.85.146.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-06-14 09:34:27 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([178.178.194.126]) [67.85.146.216]:46815: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [14/Jun/2026:09:34:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135771&pdata=https%253A%252F%252Fbutodra.tg%252F2022%252F08%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781429691 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/2022/08/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.175.146
country_id: 1210997
description:
2026-06-14 09:38:25 dovecot_plain authenticator failed for H=(b3qyqma3bddp6de7bodhjronql) [114.130.175.146]:48436: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:38:48 dovecot_login authenticator failed for H=(Z9pJPQABnq) [194.146.92.59]:38013: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.175.146
country_id: 1210997
description:
Jun 14 09:38:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.175.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:39:33 dovecot_login authenticator failed for H=(GyXtecqH) [194.146.92.59]:64690: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:40:34 dovecot_login authenticator failed for H=(JlvyF0IV5) [194.146.92.59]:21619: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:40:34 dovecot_login authenticator failed for H=(p2Q68T) [194.146.92.59]:23856: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 194.146.92.59
country_id: 2510769
description:
Jun 14 09:41:54 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 194.146.92.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:41:33 dovecot_login authenticator failed for H=(CLK1rk) [194.146.92.59]:38394: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 194.146.92.59
country_id: 2510769
description:
Jun 14 09:42:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 194.146.92.59


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:43:11 dovecot_login authenticator failed for H=(irVmjnLz0y) [194.146.92.59]:65171: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:42:20 dovecot_login authenticator failed for H=(egfjWg4ml) [194.146.92.59]:38379: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:43:33 dovecot_login authenticator failed for H=(gFXHlweJKy) [194.146.92.59]:57223: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 194.146.92.59
country_id: 2510769
description:
Jun 14 09:43:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin-lirtg@cafe.tg has been locked for the attacker IP 194.146.92.59


plugin: modsec
rule: 77065534
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html lang=\"en-GB\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"TTP\")</script>\n<meta charset=\"utf-8\">\n<title>SL888: Slot Link Gacor Terbaik Malam Ini Anti Rungkad Gampag Maxwin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/batteries-powersonic.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"SL888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. Dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, SL888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. Berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. Tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\">\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n<meta http-equiv=\"content-language\" content=\"en-ID\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"SL888\">\n<meta name=\"author\" content=\"SL888\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"SL888\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhZrk-AdJ47e9IJVdmcu4hbuTQxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jN5WV4yGC6bv-Y8gTz1rwqhWHeiQ:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@Situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"SL888: Slot Link Gacor Terbaik Malam Ini Anti Rungkad Gampag Maxwin\" />\n<meta property=\"og:description\" content=\" SL888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. Dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, SL888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. Berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. Tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"USD\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"Etsy\" /><meta name=\"application-name\" content=\"Etsy\" /><meta name=\"msapplication-TileColor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-FI\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-AU\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-DK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-HK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-IE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-IL\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-IN\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-NZ\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-NO\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-SE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-SG\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-GB\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-AT\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-CH\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl-BE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es-MX\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-US\" />\n<script nonce=\"gPiNOjdRCrWLas5Ik2CuS+N0\">\n    !function(e){var r=e.__etsy_logging={};r.errorQueue=[],e.onerror=function(e,o,t,n,s){r.errorQueue.push([e,o,t,n,s])},r.firedEvents=[];r.perf={e:[],t:!1,MARK_MEASURE_PREFIX:\"_etsy_mark_measure_\",prefixMarkMeasure:function(e){return\"_etsy_mark_measure_\"+e}},e.PerformanceObserver&&(r.perf.o=new PerformanceObserver((function(e){r.perf.e=r.perf.e.concat(e.getEntries())})),r.perf.o.observe({entryTypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Possible XSS in arguments||MV:\n\n\n\n\n\n\n\n<!doctype html>\n<html lang=\"en-gb\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"ttp\")</script>\n<meta charset=\"utf-8\">\n<title>sl888: slot link gacor terbaik malam ini anti rungkad gampag maxwin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/batteries-powersonic.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"sl888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, sl888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\">\n<meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\n<meta http-equiv=\"content-language\" content=\"en-id\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"sl888\">\n<meta name=\"author\" content=\"sl888\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"sl888\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhzrk-adj47e9ijvdmcu4hbutqxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jn5wv4ygc6bv-y8gtz1rwqhwheiq:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"sl888: slot link gacor terbaik malam ini anti rungkad gampag maxwin\" />\n<meta property=\"og:description\" content=\" sl888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, sl888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"usd\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"etsy\" /><meta name=\"application-name\" content=\"etsy\" /><meta name=\"msapplication-tilecolor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-fi\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-au\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-dk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-hk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-ie\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-il\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-in\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-nz\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-no\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-se\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-sg\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-gb\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-at\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-ch\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl-be\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es-mx\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-us\" />\n<script nonce=\"gpinojdrcrwlas5ik2cus n0\">\n    !function(e){var r=e.__etsy_logging={};r.errorqueue=[],e.onerror=function(e,o,t,n,s){r.errorqueue.push([e,o,t,n,s])},r.firedevents=[];r.perf={e:[],t:!1,mark_measure_prefix:\"_etsy_mark_measure_\",prefixmarkmeasure:function(e){return\"_etsy_mark_measure_\" e}},e.performanceobserver&&(r.perf.o=new performanceobserver((function(e){r.perf.e=r.perf.e.concat(e.getentries())})),r.perf.o.observe({entrytypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 194.146.92.59
country_id: 2510769
description:
Jun 14 09:44:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin-lirtg@cafe.tg has been locked for the attacker IP 194.146.92.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:44:24 dovecot_login authenticator failed for H=(Ga4vjV) [194.146.92.59]:13086: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 09:46:09 ns5.netmaster.tg cpanel_fileman_hook[3166922]: 0 BAILOUT malware detected when upload 'ekeasarl.com (4).zip' in /home/edjatiapougloe/public_html for user edjatiapougloe


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.244.119.8
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-45.207.244.119.8||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.235.253.35
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-45.23.235.253.35||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.92.222.200
country_id: 798544
description:
2026-06-14 09:45:34 dovecot_login authenticator failed for H=213-92-222-200.serv-net.pl [213.92.222.200]:36515: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: togomedia24.tg
description:


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: togodailynews.tg
description:


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: togoathletisme.tg
description:


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: togofeed.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:48:18 dovecot_login authenticator failed for H=(2CJ0ZuJL) [194.146.92.59]:4593: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.192
country_id: 99237
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/10 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 79.127.129.198
country_id: 1861060
domain: flp-tg.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.16||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.243.253.244
country_id: 1643084
description:
Jun 14 09:50:38 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.243.253.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.243.253.244
country_id: 1643084
description:
2026-06-14 09:50:40 dovecot_plain authenticator failed for H=([192.168.1.9]) [180.243.253.244]:20894: 535 Incorrect authentication data (set_id=visite%40cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.79
country_id: 3865483
description:
Jun 14 09:51:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc1f29f3d700ad5d279a09c346a36870f0c5e5ae||Title:7pm3282ieej3cc2||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
country_id: 1655842
description:
Jun 14 09:54:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:569af0d3a870e3ed858fbf045ade7aa9b2fc3aed||Title:og8or8r671hlvxri||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:88b6d44e5dad3b2a1f6ded6d9278ac5bdf0b777f||Title:2s03l95rrkw6f5l3||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 185.177.9.158
country_id: 3057568
domain: togosem.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:665bef8cc0ee636885aba9e8a28319f9d8ad41fd||Title:2dl4vl92kqggod8bt||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b004e5688fbb0214d9e5d541dab1095a9b37225||Title:qffb6c38y4jlvb||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:14abf4894e885a105f73aea7837332dc22b69999||Title:9jhw3x3rod3f6zepw||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79135434bfec783a77b2c64559eb83dd4167ab05||Title:i2vaii0icw23dtbhw||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:13258704800bc0e800299aa7c7744aac500594c3||Title:oln7yl33vzibarpfh||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 10:00:35 ns5.netmaster.tg cpanel_fileman_hook[3174386]: 0 BAILOUT malware detected when save 'index.php' in /home/edjatiapougloe/public_html/testimonial/aely-mayen for user edjatiapougloe


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.206.120.248
country_id: 357994
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7b067e7cba96ab940799c25234bee2f6b67981a||Title:ogiycify5l2sy6kx||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun 14 10:06:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [14/Jun/2026:10:07:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514791&pdata=http%253A%252F%252Fwww.immo.mesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781431624 HTTP/1.1" 302 0 www.immo.mesyscom.com "http://www.immo.mesyscom.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.9.20.2
country_id: 2017370
description:
2026-06-14 10:08:17 dovecot_login authenticator failed for H=(csmJLMD) [195.9.20.2]:48988: 535 Incorrect authentication data (set_id=jtchagou@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.9.20.2
country_id: 2017370
description:
Jun 14 10:08:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.9.20.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.101
country_id: 1880251
description:
47.128.121.101 - - [14/Jun/2026:10:07:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171992&pdata=https%253A%252F%252Fdirect7.tg%252Fcategory%252Farticles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781431662 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/category/articles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.101


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: zephyr.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"x_08de77cd\":\"8b7693672f160921\",\"_response\":{\"_prefix\":\"var wnul=arguments['\\\\x31'];var bsbv=wnul;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.234.142
country_id: 798544
description:
Jun 14 10:14:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.234.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.163
country_id: 1880251
description:
[2026-06-14 10:15:47 +0000] info [whostmgrd] 104.28.160.163 - abttogo "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun 14 10:16:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.93
country_id: 6252001
description:
[2026-06-14 10:17:51 +0000] info [cpaneld] 195.63.9.93 - camaegdtomgo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-06-14 10:19:57 dovecot_login authenticator failed for H=([175.200.217.128]) [41.219.149.74]:43610: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.219.149.74
country_id: 2328926
description:
Jun 14 10:19:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.219.149.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 156.38.87.252
country_id: 2363686
domain: launetogo.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[wp_autosave][content]||MV:&nbsp;\n\nCap sur la tradition. Les pr\xc3\xa9paratifs de l\xe2\x80\x99\xc3\xa9dition 2026 des Evala entrent dans leur phase finale. Rendez-vous culturel le plus embl\xc3\xa9matique du nord Togo, le festival des jeunes initi\xc3\xa9s kaby\xc3\xa8 se tiendra du samedi 11 au samedi 18 juillet dans la r\xc3\xa9gion de la Kara, \xc3\xa0 450 km de Lom\xc3\xa9.\n\nPendant sept jours, les ar\xc3\xa8nes vont r\xc3\xa9sonner. Les jeunes Kaby\xc3\xa8, sortis du bois sacr\xc3\xa9, s\xe2\x80\x99affronteront dans des luttes traditionnelles o\xc3\xb9 se m\xc3\xaalent puissance physique, ma\xc3\xaetrise technique et endurance mentale. Plus qu\xe2\x80\x99un sport, c\xe2\x80\x99est un examen. Chaque prise, chaque chute devant les familles, les anciens et les communaut\xc3\xa9s venues de toute la r\xc3\xa9gion consacre le passage de l\xe2\x80\x99adolescence \xc3\xa0 l\xe2\x80\x99\xc3\xa2ge d\xe2\x80\x99homme.\n\nLe coup d\xe2\x80\x99envoi sera donn\xc3\xa9 dans le canton de Pya. L\xe2\x80\x99opposition d\xe2\x80\x99ouverture mettra aux prises les lutteurs de Lao-Haut et ceux de Lao-Bas. Une affiche symbolique pour lancer des hostilit\xc3\xa9s qui marqueront toute la semaine.\n\nLes Evala ne se r\xc3\xa9sument pas aux corps-\xc3\xa0-corps dans l\xe2\x80\x99ar\xc3\xa8ne. Ce rite initiatique majeur structure la soci\xc3\xa9t\xc3\xa9 kaby\xc3\xa8. Il transmet les valeurs de courage, de respect des a\xc3\xaen\xc3\xa9s, de solidarit\xc3\xa9 et de responsabilit\xc3\xa9. En faisant entrer les jeunes dans la communaut\xc3\xa9 des adultes, il garantit la continuit\xc3\xa9 d\xe2\x80\x99une identit\xc3\xa9 culturelle mill\xc3\xa9naire.\n\nAu-del\xc3\xa0 de l\xe2\x80\x99ar\xc3\xa8ne, la Kara se transforme. Manifestations culturelles, danses, chants, activit\xc3\xa9s foraines et foires animent villes et villages. C\xe2\x80\x99est aussi la grande saison des retrouvailles : fils et filles de la r\xc3\xa9gion, Togolais d\xe2\x80\x99autres terroirs et diaspora convergent vers la Kara. L\xe2\x80\x99\xc3\xa9v\xc3\xa9nement devient alors un moment de communion, de m\xc3\xa9moire partag\xc3\xa9e et de valorisation du patrimoine togolais dans toute sa diversit\xc3\xa9.\n\nAvec l\xe2\x80\x99\xc3\xa9dition 2026, la tradition ne se contente pas de se r\xc3\xa9p\xc3\xa9ter : elle se r\xc3\xa9affirme. Et Pya, d\xc3\xa8s le 11 juillet, en donnera le premier \xc3\xa9lan.\n\nTu veux que je te propose aussi des accroches et sous-titres pour RS pour mettre en avant l\xe2\x80\x99aspect culturel vs sportif ?||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [14/Jun/2026:10:27:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922709&pdata=https%253A%252F%252Fchuso.tg%252Fservice_chuso%252Funite-des-soins-intensifs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781432862 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/service_chuso/unite-des-soins-intensifs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 156.38.87.252
country_id: 2363686
domain: launetogo.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[wp_autosave][post_title]||MV:Evala 2026 : La Kara s\xe2\x80\x99appr\xc3\xaate \xc3\xa0 vibrer au rythme du rite initiatique kaby\xc3\xa8 du 11 au 18 juillet||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.164.91.175
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:141.164.91.175||TA:141.164.91.175||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 103.240.166.238
country_id: 1819730
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-le-systeme-national-de-transfusion-sanguine-renforce/||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 212.119.46.128
country_id: 294640
domain: crepsad.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:O*uA1rGKySypSQd)Z&%rIQT*.crepsad.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 155.212.111.13
country_id: 3017382
domain: www.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Caf3cl0ud2022!.www.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 2.58.74.244
country_id: 3202326
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-31.2.58.74.244||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.203.115.223
country_id: 6252001
description:
2026-06-14 10:37:11 dovecot_plain authenticator failed for H=(wo693jtmcwjco5kr9hzxn84me8q5) [170.203.115.223]:9580: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [14/Jun/2026:10:38:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777959&pdata=https%253A%252F%252Fbutodra.tg%252Fservice%252Ffinance-and-restructuring%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781433527 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/service/finance-and-restructuring/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.165.173.143
country_id: 1562822
description:
14.165.173.143 - - [14/Jun/2026:10:38:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157781&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D8816&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781433532 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=8816" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.3134.1700 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.165.173.143


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.227.96
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.111.227.96||TA:142.111.227.96||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.221.83
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.172.221.83||TA:107.172.221.83||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.119.252
country_id: 798544
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.113.119.252||TA:92.113.119.252||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.150.177.222
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:45.150.177.222||TA:45.150.177.222||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.49.184
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.49.184||TA:104.252.49.184||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.240.243.145
country_id: 2464461
description:
197.240.243.145 - - [14/Jun/2026:10:44:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7497619&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvictoire-tomegah-dogbe-plus-proche-de-sa-base%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781433868 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/victoire-tomegah-dogbe-plus-proche-de-sa-base/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.3681.1185 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.240.243.145


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.101
country_id: 2077456
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:202.155.186.101||TA:202.155.186.101||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.150.179.217
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:45.150.179.217||TA:45.150.179.217||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.234
country_id: 2510769
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.143.245.234||TA:104.143.245.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.80.188
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.80.188||TA:104.239.80.188||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.49.200
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.49.200||TA:104.252.49.200||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.208.167
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.175.208.167||TA:107.175.208.167||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-14 10:45:52 +0000] info [cpaneld] 103.253.27.219 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.53.156
country_id: 2750405
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:145.223.53.156||TA:145.223.53.156||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.120.86
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.120.86||TA:152.232.120.86||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.116.221
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.172.116.221||TA:107.172.116.221||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.202.248.216
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:46.202.248.216||TA:46.202.248.216||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.122.18
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.122.18||TA:198.105.122.18||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.254.184
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.254.184||TA:148.135.254.184||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.144.43
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.144.43||TA:148.135.144.43||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 171.22.251.117
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:171.22.251.117||TA:171.22.251.117||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.221.144
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.172.221.144||TA:107.172.221.144||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.141.51
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.141.51||TA:107.181.141.51||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.223.109
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.223.109||TA:104.253.223.109||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.119.218
country_id: 798544
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.113.119.218||TA:92.113.119.218||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.165.112
country_id: 2077456
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.112.165.112||TA:92.112.165.112||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.98
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.144.190.98||TA:198.144.190.98||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.116.150
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.172.116.150||TA:107.172.116.150||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.26.136
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.233.26.136||TA:104.233.26.136||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.46.137.101
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.46.137.101||TA:198.46.137.101||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.1.179.117
country_id: 1814991
description:
2026-06-14 10:46:42 dovecot_login authenticator failed for H=([49.124.152.171]) [116.1.179.117]:44202: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.1.179.117
country_id: 1814991
description:
Jun 14 10:46:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.1.179.117 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.192.47
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.111.192.47||TA:142.111.192.47||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.231.187
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:213.169.231.187||TA:213.169.231.187||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.130.117
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.130.117||TA:161.123.130.117||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.57.177
country_id: 2750405
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:145.223.57.177||TA:145.223.57.177||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.205.159
country_id: 1814991
description:
Jun 14 10:48:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.205.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 14 10:49:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 14 10:52:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.203.115.223
country_id: 6252001
description:
2026-06-14 10:55:54 dovecot_plain authenticator failed for H=(nf7f3pcou1bebm5pf98cv23r) [170.203.115.223]:23749: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.216.74
country_id: 2661886
description:
[2026-06-14 10:58:15 +0000] info [cpaneld] 149.50.216.74 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.99.117.84
country_id: 1562822
description:
2026-06-14 10:58:48 dovecot_plain authenticator failed for H=(swjzvpuiy2hm7krzws) [116.99.117.84]:59199: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.220.241.50
country_id: 1814991
description:
2026-06-14 11:01:42 dovecot_login authenticator failed for H=(ipmapt-72-195-114-188.oc.oc.cox.net) [60.220.241.50]:44268: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.125.94.245
country_id: 6252001
description:
34.125.94.245 - - [14/Jun/2026:11:04:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922916&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F10%252Ffootball-le-togo-surclasse-le-benin-et-conclut-sa-fenetre-fifa-en-beaute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781435079 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/10/football-le-togo-surclasse-le-benin-et-conclut-sa-fenetre-fifa-en-beaute/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.125.94.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-06-14 11:05:58 dovecot_login authenticator failed for H=([121.66.124.149]) [103.147.248.23]:37758: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.29.30.135
country_id: 1527747
description:
Jun 14 11:06:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.29.30.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.23
country_id: 1269750
description:
Jun 14 11:05:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-06-14 11:06:05 dovecot_login authenticator failed for H=(95-165-159-70.static.spd-mgts.ru) [217.29.30.135]:41664: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.125.94.245
country_id: 6252001
description:
34.125.94.245 - - [14/Jun/2026:11:05:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7497669&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F10%252Ffootball-le-togo-surclasse-le-benin-et-conclut-sa-fenetre-fifa-en-beaute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781435154 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/10/football-le-togo-surclasse-le-benin-et-conclut-sa-fenetre-fifa-en-beaute/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.125.94.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2026-06-14 11:06:32 dovecot_login authenticator failed for H=(ip-084-118-020-106.um23.pools.vodafone-ip.de) [37.25.36.197]:35123: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
country_id: 294640
description:
Jun 14 11:06:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 14 11:09:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 103.85.229.102
country_id: 1861060
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:bceao-lancement-imminent-dun-systeme-de-paiement-instantane-interoperable/||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.230.64
country_id: 1814991
description:
Jun 14 11:13:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.230.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.230.64
country_id: 1814991
description:
2026-06-14 11:13:20 dovecot_login authenticator failed for H=([36.151.68.6]) [123.118.230.64]:49812: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [14/Jun/2026:11:17:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198439&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccination-covid-19-en-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781435835 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccination-covid-19-en-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.200.79
country_id: 2413451
description:
Jun 14 11:24:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.200.79 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.26.243.52
country_id: 6252001
description:
52.26.243.52 - - [14/Jun/2026:11:26:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183217&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F5c90f2f921bb381fb6596f228113d0c7%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781436361 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/5c90f2f921bb381fb6596f228113d0c7/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.26.243.52


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.175
country_id: 3469034
description:
Jun 14 11:26:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.38.58.209
country_id: 290557
description:
5.38.58.209 - - [14/Jun/2026:11:29:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328426&pdata=https%253A%252F%252Fcpanel.leveinard.free.netmaster.tg%252F%253Flocale%253Dit&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781436567 HTTP/2.0" 302 0 cpanel.leveinard.free.netmaster.tg "https://cpanel.leveinard.free.netmaster.tg/?locale=it" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.38.58.209


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.144.178
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/une-etape-de-plus-pour-fesdev-a-lendroit-des-jeunes-filles/<script async src||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.38.170.3
country_id: 6252001
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/la-gamme-de-boissons-gazeuses-de-la-snb-presentee-a-la-presse HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Jun 14 11:32:53 ns5 pure-ftpd[3225707]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.216.70
country_id: 2661886
description:
[2026-06-14 11:45:14 +0000] info [cpaneld] 149.50.216.70 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.237.131
country_id: 3625428
description:
Jun 14 11:49:49 ns5 pure-ftpd[3235427]: (?@95.181.237.131) [INFO] New connection from 95.181.237.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.89.115
country_id: 2750405
description:
[2026-06-14 11:50:03 +0000] info [cpaneld] 217.181.89.115 - camaegdtomgo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.97.228.153
country_id: 1605651
description:
171.97.228.153 - - [14/Jun/2026:11:53:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069680&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781438015 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.6953.1010 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.97.228.153


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.191.31
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.191.31||TA:148.135.191.31||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.70.75.89
country_id: 2921044
description:
[2026-06-14 12:06:22 +0000] info [cpaneld] 31.70.75.89 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: soena.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.174.78
country_id: 1269750
description:
Jun 14 12:10:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.174.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-06-14 12:10:46 dovecot_login authenticator failed for H=([192.111.135.19]) [122.187.174.78]:56068: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.69.48.253
country_id: 2921044
domain: cogerisq.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:ygeaivhj||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.140
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-11.176.97.79.140||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 3.69.48.253
country_id: 2921044
domain: cogerisq.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.16||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.250.39.153
country_id: 1814991
description:
2026-06-14 12:12:28 dovecot_login authenticator failed for H=([128.185.176.81]) [118.250.39.153]:50978: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.250.39.153
country_id: 1814991
description:
Jun 14 12:12:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.250.39.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.69.48.253
country_id: 2921044
domain: cogerisq.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:ygeaivhj||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.128
country_id: 3175395
description:
Jun 14 12:14:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.128 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 18.220.246.78
country_id: 6252001
domain: metaart.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:ebbmnmtd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.200.151
country_id: 2413451
description:
Jun 14 12:15:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.200.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Jun 14 12:16:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.140
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-16.176.97.79.140||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 14 12:16:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.242.230.113
country_id: 3017382
description:
[2026-06-14 12:18:57 +0000] info [cpaneld] 38.242.230.113 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.123.0.69
country_id: 2921044
domain: libertetogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:libertepansel||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.123.0.69
country_id: 2921044
domain: libertetogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:libertepansel||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.132.227.195
country_id: 6252001
description:
45.132.227.195 - - [14/Jun/2026:12:20:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919836&pdata=https%253A%252F%252Flaunetogo.tg%252Fmedia-days-du-gnebtp-togo-quand-le-btp-sexplique-pour-mieux-construire-le-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781439640 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/media-days-du-gnebtp-togo-quand-le-btp-sexplique-pour-mieux-construire-le-togo/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.132.227.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.242.230.113
country_id: 3017382
description:
[2026-06-14 12:21:24 +0000] info [cpaneld] 38.242.230.113 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.164.238.92
country_id: 1835841
domain: delxia.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:zykoahbv||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-14 12:23:05 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [14/Jun/2026:12:23:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130582&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781439798 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.70.75.89
country_id: 2921044
description:
[2026-06-14 12:23:45 +0000] info [cpaneld] 31.70.75.89 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.247
country_id: 2921044
description:
Jun 14 12:29:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.247
country_id: 2921044
description:
2026-06-14 12:29:49 dovecot_plain authenticator failed for H=tor-exit-8.zbau.f3netze.de (fl8fjcz85mdkyixod8ackmi5ro6m1) [185.220.100.247]:41298: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 52.33.88.201
country_id: 6252001
domain: autodiscover.sproca.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.213.175.53
country_id: 1643084
domain: sia-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-31.140.213.175.53||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.70.75.89
country_id: 2921044
description:
[2026-06-14 12:32:05 +0000] info [cpaneld] 31.70.75.89 - sodegoz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodegoz (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.207.15.4
country_id: 1814991
description:
Jun 14 12:35:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.207.15.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.207.15.4
country_id: 1814991
description:
2026-06-14 12:35:28 dovecot_login authenticator failed for H=([182.95.63.50]) [140.207.15.4]:58302: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.236.34
country_id: 2017370
description:
Jun 14 12:39:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.236.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.236.34
country_id: 2017370
description:
2026-06-14 12:39:10 dovecot_login authenticator failed for H=(124.107.185.138.pldt.net) [5.142.236.34]:58994: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.84.107.55
country_id: 2661886
description:
45.84.107.55 - glfmqhlj [14/Jun/2026:12:39:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183299&pdata=https%253A%252F%252Fafriquerevelation.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781440749 HTTP/2.0" 302 0 afriquerevelation.tg "https://afriquerevelation.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.84.107.55


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.79.253
country_id: 6252001
description:
[2026-06-14 12:38:24 +0000] info [cpaneld] 217.181.79.253 - xflhqsmv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.76.188
country_id: 6252001
description:
[2026-06-14 12:38:29 +0000] info [cpaneld] 217.181.76.188 - ubwmytwf "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ubwmytwf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.64.79
country_id: 6252001
description:
[2026-06-14 12:39:52 +0000] info [cpaneld] 217.181.64.79 - apicafe "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.73.65
country_id: 6252001
description:
[2026-06-14 12:40:27 +0000] info [cpaneld] 217.181.73.65 - arsetg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.146
country_id: 3469034
description:
Jun 14 12:40:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.216.70
country_id: 2661886
description:
[2026-06-14 12:42:50 +0000] info [cpaneld] 149.50.216.70 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.22.250
country_id: 2921044
description:
[2026-06-14 12:44:14 +0000] info [cpaneld] 195.63.22.250 - hsufgiqg "GET / HTTP/1.1" FAILED LOGIN cpaneld: User hsufgiqg has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.70.75.89
country_id: 2921044
description:
[2026-06-14 12:43:28 +0000] info [cpaneld] 31.70.75.89 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.183.141
country_id: 1880251
description:
43.134.183.141 - - [14/Jun/2026:12:45:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277892&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-echanges-fructueux-entre-faure-gnassingbe-et-xavier-bettel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781441112 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-echanges-fructueux-entre-faure-gnassingbe-et-xavier-bettel/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.183.141


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.229
country_id: 2921044
description:
[2026-06-14 12:45:51 +0000] info [cpaneld] 217.181.84.229 - zgqykfsi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.135
country_id: 2921044
description:
[2026-06-14 12:45:55 +0000] info [cpaneld] 217.181.86.135 - vefzejhd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.88.138.45
country_id: 690791
domain: bawasongroup.com
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:waywcbyw||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.232
country_id: 2921044
description:
[2026-06-14 12:47:16 +0000] info [cpaneld] 217.181.85.232 - egjvuiox "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.212
country_id: 2921044
description:
[2026-06-14 12:47:42 +0000] info [cpaneld] 217.181.84.212 - assedderetrm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.170
country_id: 2635167
description:
[2026-06-14 12:49:03 +0000] info [cpaneld] 217.181.93.170 - muzsajnk "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.44
country_id: 2635167
description:
[2026-06-14 12:49:06 +0000] info [cpaneld] 217.181.94.44 - centif "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.247
country_id: 2635167
description:
[2026-06-14 12:49:21 +0000] info [cpaneld] 217.181.95.247 - afdim "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.232
country_id: 2635167
description:
[2026-06-14 12:49:23 +0000] info [cpaneld] 195.63.23.232 - cfpjusti "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.248
country_id: 2635167
description:
[2026-06-14 12:50:20 +0000] info [cpaneld] 195.63.26.248 - cloudetracks "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.219
country_id: 6252001
domain: www.centif.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.170
country_id: 2635167
description:
[2026-06-14 12:50:53 +0000] info [cpaneld] 217.181.93.170 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.36.118
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.36.118||TA:104.238.36.118||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.149
country_id: 2635167
description:
[2026-06-14 12:51:09 +0000] info [cpaneld] 217.181.95.149 - fnnjmavs "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.191
country_id: 2635167
description:
[2026-06-14 12:52:13 +0000] info [cpaneld] 195.63.25.191 - wcdxbboq "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.107
country_id: 3865483
description:
Jun 14 12:53:06 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.103
country_id: 6252001
description:
[2026-06-14 12:53:12 +0000] info [cpaneld] 217.181.75.103 - myxlsnta "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.107
country_id: 3865483
description:
Jun 14 12:53:21 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.139
country_id: 6252001
description:
[2026-06-14 12:55:16 +0000] info [cpaneld] 217.181.75.139 - mvfxewjz "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.65.69
country_id: 6252001
description:
[2026-06-14 12:55:52 +0000] info [cpaneld] 217.181.65.69 - dgdntogo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.78.187
country_id: 6252001
description:
[2026-06-14 12:56:14 +0000] info [cpaneld] 217.181.78.187 - bjwcjsqs "GET / HTTP/1.1" FAILED LOGIN cpaneld: User bjwcjsqs has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.71.174
country_id: 6252001
description:
[2026-06-14 12:55:21 +0000] info [cpaneld] 217.181.71.174 - davetkoo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.71.173
country_id: 6252001
description:
[2026-06-14 12:56:24 +0000] info [cpaneld] 217.181.71.173 - ylhgcaui "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.64.2
country_id: 6252001
description:
[2026-06-14 12:56:28 +0000] info [cpaneld] 217.181.64.2 - edjatiapougloe "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.74.137
country_id: 6252001
description:
[2026-06-14 12:57:03 +0000] info [cpaneld] 217.181.74.137 - uubplgpf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.33
country_id: 6252001
description:
[2026-06-14 12:57:08 +0000] info [cpaneld] 217.181.69.33 - vodvpozo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.103
country_id: 6252001
description:
[2026-06-14 12:57:13 +0000] info [cpaneld] 217.181.75.103 - kygyhxkc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.74.134
country_id: 6252001
description:
[2026-06-14 12:57:17 +0000] info [cpaneld] 217.181.74.134 - afgqjhmw "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.77.91
country_id: 6252001
description:
[2026-06-14 12:56:20 +0000] info [cpaneld] 217.181.77.91 - zmfpejke "GET / HTTP/1.1" FAILED LOGIN cpaneld: User zmfpejke has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.127.11.162
country_id: 2328926
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/42.jpeg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.190
country_id: 2300660
description:
Jun 14 12:58:11 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.190
country_id: 2300660
description:
Jun 14 12:58:18 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.30.130
country_id: 2750405
description:
[2026-06-14 12:59:00 +0000] info [cpaneld] 195.63.30.130 - tubobkfl "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.89.193
country_id: 2750405
description:
[2026-06-14 12:59:03 +0000] info [cpaneld] 217.181.89.193 - phoicdxb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.88.221
country_id: 2750405
description:
[2026-06-14 12:59:11 +0000] info [cpaneld] 217.181.88.221 - rdlizssu "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.28.46
country_id: 2750405
description:
[2026-06-14 12:59:14 +0000] info [cpaneld] 195.63.28.46 - jvrzfkho "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.148
country_id: 3175395
description:
Jun 14 12:59:57 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.148 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.205.209
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:38.154.205.209||TA:38.154.205.209||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.232.209.43
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.232.209.43||TA:104.232.209.43||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.46.241.145
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.46.241.145||TA:198.46.241.145||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.242.168
country_id: 2510769
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.113.242.168||TA:92.113.242.168||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.52
country_id: 690791
description:
Jun 14 13:00:22 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.52 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.25.110
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:191.101.25.110||TA:191.101.25.110||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.148.155
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.148.155||TA:107.181.148.155||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.230.214
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:213.169.230.214||TA:213.169.230.214||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.75.229.102
country_id: 2802361
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:103.75.229.102||TA:103.75.229.102||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.181.129
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:191.101.181.129||TA:191.101.181.129||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.20.138
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.20.138||TA:104.252.20.138||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.159.12
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.121.159.12||TA:172.121.159.12||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.150.56
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.173.150.56||TA:107.173.150.56||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.241.110
country_id: 1880251
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.113.241.110||TA:92.113.241.110||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.241.118.100
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:192.241.118.100||TA:192.241.118.100||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.211.30.250
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.211.30.250||TA:173.211.30.250||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.227.113.103
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:67.227.113.103||TA:67.227.113.103||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.193.169
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.193.169||TA:104.252.193.169||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.29.149
country_id: 2750405
description:
[2026-06-14 13:01:22 +0000] info [cpaneld] 195.63.29.149 - fgbegmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.48.178
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.48.178||TA:104.253.48.178||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.19.200
country_id: 3175395
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.19.200||TA:104.239.19.200||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.119.182.176
country_id: 2921044
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.119.182.176||TA:92.119.182.176||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.100.135
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.100.135||TA:198.105.100.135||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.177.99
country_id: 2750405
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.177.99||TA:148.135.177.99||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.25.167.224
country_id: 2750405
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:193.25.167.224||TA:193.25.167.224||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.218.234
country_id: 2077456
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:46.203.218.234||TA:46.203.218.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.119.229
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.175.119.229||TA:107.175.119.229||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.20.185.203
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.20.185.203||TA:198.20.185.203||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.217.207
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:38.154.217.207||TA:38.154.217.207||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.201.248
country_id: 3190538
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.201.248||TA:209.242.201.248||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.119.10
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.175.119.10||TA:107.175.119.10||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.54.132
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:145.223.54.132||TA:145.223.54.132||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.75.102
country_id: 3017382
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:216.173.75.102||TA:216.173.75.102||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.50.158
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.50.158||TA:104.238.50.158||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.33.186
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.33.186||TA:104.239.33.186||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.92.174
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.92.174||TA:104.252.92.174||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.38.104
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.38.104||TA:104.238.38.104||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.211.69.178
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.211.69.178||TA:173.211.69.178||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.253.77
country_id: 2562770
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.202.253.77||TA:142.202.253.77||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.37.130
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.37.130||TA:104.238.37.130||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.195.181
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:89.249.195.181||TA:89.249.195.181||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.176.99.149
country_id: 798549
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:193.176.99.149||TA:193.176.99.149||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.76.164
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:216.173.76.164||TA:216.173.76.164||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.102.123
country_id: 458258
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:45.131.102.123||TA:45.131.102.123||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.165.84
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.117.165.84||TA:217.117.165.84||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.23.214.172
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.23.214.172||TA:198.23.214.172||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.245.192
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.147.245.192||TA:142.147.245.192||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.221.29
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.172.221.29||TA:107.172.221.29||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.43.218
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.43.218||TA:104.239.43.218||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.15.104
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.233.15.104||TA:104.233.15.104||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.93.187.132
country_id: 3017382
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:204.93.187.132||TA:204.93.187.132||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.252.249
country_id: 2750405
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.101.252.249||TA:185.101.252.249||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.11.209
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:191.101.11.209||TA:191.101.11.209||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 138.128.148.39
country_id: 2921044
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:138.128.148.39||TA:138.128.148.39||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.155.156
country_id: 2077456
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.112.155.156||TA:92.112.155.156||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.172.133
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:192.186.172.133||TA:192.186.172.133||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 138.128.148.152
country_id: 2921044
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:138.128.148.152||TA:138.128.148.152||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.121.125
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.121.125||TA:198.105.121.125||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.101.102
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.101.102||TA:152.232.101.102||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.215.244
country_id: 2077456
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.215.244||TA:161.123.215.244||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.217.222
country_id: 2661886
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.112.217.222||TA:92.112.217.222||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.174.128.147
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.174.128.147||TA:107.174.128.147||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.217
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.121.139.217||TA:172.121.139.217||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.198.177.197
country_id: 3175395
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.198.177.197||TA:217.198.177.197||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.241.118.27
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:192.241.118.27||TA:192.241.118.27||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.142.181
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.142.181||TA:107.181.142.181||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.103.248
country_id: 458258
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:45.131.103.248||TA:45.131.103.248||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.148.132
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.148.132||TA:148.135.148.132||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 179.61.245.106
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:179.61.245.106||TA:179.61.245.106||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.203.168
country_id: 3190538
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.203.168||TA:209.242.203.168||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.102.148
country_id: 458258
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:45.131.102.148||TA:45.131.102.148||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.123.175
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.123.175||TA:152.232.123.175||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.165
country_id: 2921044
description:
[2026-06-14 13:05:53 +0000] info [cpaneld] 217.181.84.165 - nwvfmxat "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.97.9
country_id: 3469034
description:
Jun 14 13:05:58 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.97.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.245
country_id: 2921044
description:
[2026-06-14 13:06:36 +0000] info [cpaneld] 217.181.85.245 - zmmjcejv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.3
country_id: 2921044
description:
[2026-06-14 13:06:51 +0000] info [cpaneld] 217.181.86.3 - lhxhatyj "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.213
country_id: 2921044
description:
[2026-06-14 13:07:17 +0000] info [cpaneld] 217.181.85.213 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.110.112.148
country_id: 3865483
description:
Jun 14 13:06:20 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.110.112.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.20.131
country_id: 2921044
description:
[2026-06-14 13:07:31 +0000] info [cpaneld] 195.63.20.131 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.127
country_id: 2921044
description:
[2026-06-14 13:09:16 +0000] info [cpaneld] 217.181.86.127 - dxsiclpd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.180
country_id: 3469034
description:
Jun 14 13:10:06 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.3
country_id: 2921044
description:
[2026-06-14 13:10:58 +0000] info [cpaneld] 217.181.86.3 - jmtctoni "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.180
country_id: 3469034
description:
Jun 14 13:10:20 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.180 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.15
country_id: 1814991
description:
123.6.49.15 - - [14/Jun/2026:13:11:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989225&pdata=http%253A%252F%252Faspmx.wages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781442680 HTTP/1.1" 404 561 aspmx.wages.tg "http://aspmx.wages.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.19.252
country_id: 2921044
description:
[2026-06-14 13:14:11 +0000] info [cpaneld] 195.63.19.252 - moodlefreenetmas "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.212.2
country_id: 1562822
domain: www.cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-et-racks.tg/?trk=public_post-text HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.212.2
country_id: 1562822
domain: www.cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-et-racks.tghttp/www.cloud-et-racks.tg/?trk=public_post-text HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.111
country_id: 2921044
description:
[2026-06-14 13:15:22 +0000] info [cpaneld] 217.181.84.111 - neliam "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 63.179.130.126
country_id: 2921044
domain: www.matwtogo.org
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:rqgqpxof||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.22.85
country_id: 2921044
description:
[2026-06-14 13:17:36 +0000] info [cpaneld] 195.63.22.85 - pmalabvi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.212.27
country_id: 2921044
description:
2026-06-14 13:17:33 dovecot_plain authenticator failed for H=afyx.af-informatique.com (qee22i30ij9hv8hgy8w3ilswflbuxa4) [217.160.212.27]:59550: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.174
country_id: 6251999
description:
[2026-06-14 13:18:57 +0000] info [cpaneld] 217.181.82.174 - pnls "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.49
country_id: 6251999
description:
[2026-06-14 13:19:15 +0000] info [cpaneld] 217.181.82.49 - qjzcsoob "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.53.9.91
country_id: 3469034
description:
2026-06-14 13:21:19 dovecot_login authenticator failed for H=(191-53-9-91.lna-wr.soumaster.com.br) [191.53.9.91]:53175: 535 Incorrect authentication data (set_id=adegunle.bikounle@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.231
country_id: 6251999
description:
[2026-06-14 13:21:24 +0000] info [cpaneld] 217.181.81.231 - bighostingsnbd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.182
country_id: 6251999
description:
[2026-06-14 13:22:15 +0000] info [cpaneld] 195.63.16.182 - sxoyfjqv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.158.193
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.245.158.193||TA:172.245.158.193||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.249.20
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/financement-ohada-lome-carrefour-de-lintegration-africaine/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.249.20
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/financement-ohada-lome-carrefour-de-lintegration-africaine/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 2.57.23.76
country_id: 2635167
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.89.132
country_id: 2750405
description:
[2026-06-14 13:25:58 +0000] info [cpaneld] 217.181.89.132 - ulduzncs "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.30.185
country_id: 2750405
description:
[2026-06-14 13:25:22 +0000] info [cpaneld] 195.63.30.185 - waywcbyw "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.30.76
country_id: 2750405
description:
[2026-06-14 13:26:29 +0000] info [cpaneld] 195.63.30.76 - wttzshhf "GET / HTTP/1.1" FAILED LOGIN cpaneld: User wttzshhf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.27.245
country_id: 2750405
description:
[2026-06-14 13:26:44 +0000] info [cpaneld] 195.63.27.245 - cipvzfnv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.215
country_id: 2921044
description:
[2026-06-14 13:28:07 +0000] info [cpaneld] 195.63.21.215 - aogodmm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.22
country_id: 2921044
description:
[2026-06-14 13:28:10 +0000] info [cpaneld] 195.63.21.22 - vtytmwmz "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.19.252
country_id: 2921044
description:
[2026-06-14 13:28:14 +0000] info [cpaneld] 195.63.19.252 - xdkbrmjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.125.127.128
country_id: 1835841
domain: zontalomemillenium.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:wwayrzpl||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.111
country_id: 2921044
description:
[2026-06-14 13:29:34 +0000] info [cpaneld] 217.181.86.111 - aopsacai "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.132.120
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/2015/08/25/top-african-jewelry-designers/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:574999d34187b4a6a9b8ea4ccce2b2dac89b9943||Title:v7m8nwsv0jnnbug||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09e636d9f7b658e1ff9985e62dd6b612c511ddcf||Title:hiypb7e8kyjbh8j5w||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.223.227
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.223.227||TA:104.253.223.227||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.63.179
country_id: 3469034
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:108.165.63.179||TA:108.165.63.179||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.126.103
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:23.229.126.103||TA:23.229.126.103||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.136.72
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.136.72||TA:104.252.136.72||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.19.192
country_id: 3175395
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.19.192||TA:104.239.19.192||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.100.12
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.100.12||TA:198.105.100.12||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.204.31
country_id: 3190538
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.204.31||TA:209.242.204.31||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.81.193
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.81.193||TA:104.239.81.193||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.201.43
country_id: 3190538
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.201.43||TA:209.242.201.43||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:76754ed33e87b883faa1e540785655ea299a68c1||Title:68shgog8zufmj7e||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.208.196
country_id: 1861060
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.208.196||TA:161.123.208.196||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.75.211
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:216.173.75.211||TA:216.173.75.211||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.195.123
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:89.249.195.123||TA:89.249.195.123||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.74.114.132
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:216.74.114.132||TA:216.74.114.132||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.38.186
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.38.186||TA:104.238.38.186||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.151.121
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.151.121||TA:148.135.151.121||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.185
country_id: 2510769
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.143.245.185||TA:104.143.245.185||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.119.144
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.119.144||TA:198.105.119.144||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.102.68
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.102.68||TA:152.232.102.68||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.119.85
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.119.85||TA:198.105.119.85||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.116.90
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.116.90||TA:152.232.116.90||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.17.111
country_id: 3175395
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.17.111||TA:104.239.17.111||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.77.249
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.77.249||TA:104.253.77.249||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.93.184
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.173.93.184||TA:107.173.93.184||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.197.157
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:38.154.197.157||TA:38.154.197.157||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.238.239
country_id: 3077311
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.112.238.239||TA:92.112.238.239||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.218.38
country_id: 3469034
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:108.165.218.38||TA:108.165.218.38||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.202.248.104
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:46.202.248.104||TA:46.202.248.104||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.148.67
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.148.67||TA:107.181.148.67||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.230
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.121.139.230||TA:172.121.139.230||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.75.229.194
country_id: 2802361
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:103.75.229.194||TA:103.75.229.194||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.38.129
country_id: 6251999
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.38.129||TA:104.239.38.129||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.134.125
country_id: 2077456
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.113.134.125||TA:92.113.134.125||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.101.153
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.101.153||TA:152.232.101.153||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.100.106.138
country_id: 1861060
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:167.100.106.138||TA:167.100.106.138||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.101.93
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.101.93||TA:152.232.101.93||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.36.221
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.36.221||TA:104.238.36.221||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.116.250.10
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:194.116.250.10||TA:194.116.250.10||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.206.237
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:140.99.206.237||TA:140.99.206.237||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-14 13:32:57 +0000] info [cpaneld] 45.142.201.26 - AWADI "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.56.244
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.175.56.244||TA:107.175.56.244||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.200.119
country_id: 3469034
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.112.200.119||TA:92.112.200.119||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.81.133
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.81.133||TA:104.239.81.133||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.65.138
country_id: 3175395
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.65.138||TA:161.123.65.138||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.221.55.153
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:103.221.55.153||TA:103.221.55.153||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.165.234
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.117.165.234||TA:217.117.165.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.75.251
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:216.173.75.251||TA:216.173.75.251||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f3a8a24d0253aa3c658912358db4ee2164b0a310||Title:cfz2wja0ixir71j||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.102.222.97
country_id: 660013
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.102.222.97||TA:172.102.222.97||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.188.141
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.188.141||TA:148.135.188.141||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.121.143
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.37.121.143||TA:198.37.121.143||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.148.32
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.148.32||TA:107.181.148.32||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.27.228
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:184.174.27.228||TA:184.174.27.228||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.116.250.154
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:194.116.250.154||TA:194.116.250.154||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.243.101.248
country_id: 6252001
description:
2026-06-14 13:34:07 dovecot_plain authenticator failed for H=(yns4ikiru8v6eft106bg3p8gyo) [162.243.101.248]:51066: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.212.203
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:213.169.212.203||TA:213.169.212.203||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.127.43
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.127.127.43||TA:209.127.127.43||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.44.185
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:184.174.44.185||TA:184.174.44.185||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.115.244
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.115.244||TA:161.123.115.244||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.53.214
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:145.223.53.214||TA:145.223.53.214||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.100
country_id: 3469034
description:
Jun 14 13:33:55 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.100 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.161.174
country_id: 2510769
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:109.196.161.174||TA:109.196.161.174||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.100.244
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.100.244||TA:152.232.100.244||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.193.146
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:89.249.193.146||TA:89.249.193.146||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.243.101.248
country_id: 6252001
description:
Jun 14 13:34:05 ns5 auth[3270492]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.243.101.248 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.124.71
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.124.71||TA:104.239.124.71||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b2fcf7412cfd75010d502fb59aee48a763f9f3f||Title:o4ad50w5wrm07t5ny1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.221
country_id: 2077456
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:202.155.186.221||TA:202.155.186.221||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.38.151
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.38.151||TA:104.238.38.151||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.20.191.223
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.20.191.223||TA:198.20.191.223||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.90.145
country_id: 3175395
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.90.145||TA:104.253.90.145||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.138.140
country_id: 390903
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.138.140||TA:161.123.138.140||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.172.211.214
country_id: 1861060
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:195.172.211.214||TA:195.172.211.214||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bdb59ef90bce22abc2343aac8f5094053b88d5df||Title:vvmlfck77fgnhbvl||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.139.248
country_id: 2077456
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.113.139.248||TA:92.113.139.248||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.223.105
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.223.105||TA:104.253.223.105||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.72.241.152
country_id: 3469034
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.72.241.152||TA:185.72.241.152||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.227.112.249
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:67.227.112.249||TA:67.227.112.249||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.207.138
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:151.245.207.138||TA:151.245.207.138||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.245.141
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.111.245.141||TA:142.111.245.141||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.201.170
country_id: 453733
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:140.99.201.170||TA:140.99.201.170||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.55.172
country_id: 2658434
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.55.172||TA:104.253.55.172||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.69.126
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:108.165.69.126||TA:108.165.69.126||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.103.229
country_id: 2077456
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:46.203.103.229||TA:46.203.103.229||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ef8ad33263b389771ff7d9f48b6c8b6552fc1d13||Title:kopcgoc6q3drb8j||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.176.212.202
country_id: 3175395
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:94.176.212.202||TA:94.176.212.202||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9c0999ac0fd432a129df57f797f43f66ccc460c7||Title:tb4imtz24fuuf4n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d95a83776aaf0c381535d5a81a2d9efa3b73aeb8||Title:g5jck95c9yvks3ftzd||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.174.168
country_id: 2363686
description:
102.64.174.168 - - [14/Jun/2026:13:37:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660260&pdata=https%253A%252F%252Flaunetogo.tg%252Fmedia-days-du-gnebtp-togo-quand-le-btp-sexplique-pour-mieux-construire-le-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781444276 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/media-days-du-gnebtp-togo-quand-le-btp-sexplique-pour-mieux-construire-le-togo/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.174.168


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.162.40.255
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a7e94b4457dc327b98cb39d955b3c3be4534270||Title:bvr7iy69o3650n3||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.68.68.36
country_id: 2077456
description:
2026-06-14 13:39:16 dovecot_login authenticator failed for H=(ool-4351762a.dyn.optonline.net) [61.68.68.36]:39822: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


