# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 19:43:13 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.42.234.99
country_id: 6252001
description:
[2026-06-25 19:42:44 +0000] info [cpaneld] 73.42.234.99 - ameakco "GET /login/?login_only=1&user=ameakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.178.212
country_id: 6252001
description:
[2026-06-25 19:43:21 +0000] info [cpaneld] 47.149.178.212 - hap "GET /login/?login_only=1&user=hap&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hap (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 19:44:06 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-06-25 19:45:05 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg ([68.71.254.3]) [95.87.248.223]:37018: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.127.145
country_id: 6252001
description:
[2026-06-25 19:45:20 +0000] info [cpaneld] 47.16.127.145 - direct7 "GET /login/?login_only=1&user=direct7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.34.217.10
country_id: 6252001
description:
[2026-06-25 19:45:35 +0000] info [cpaneld] 65.34.217.10 - dire "GET /login/?login_only=1&user=dire&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dire (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.121.90.202
country_id: 6252001
description:
[2026-06-25 19:45:41 +0000] info [cpaneld] 50.121.90.202 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.244.9.40
country_id: 6252001
description:
[2026-06-25 19:45:23 +0000] info [cpaneld] 9.244.9.40 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.59.112.48
country_id: 6252001
description:
[2026-06-25 19:47:15 +0000] info [cpaneld] 184.59.112.48 - tontoned "GET /login/?login_only=1&user=tontoned&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontoned (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.36.90.254
country_id: 6252001
description:
[2026-06-25 19:47:22 +0000] info [cpaneld] 68.36.90.254 - tonton "GET /login/?login_only=1&user=tonton&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tonton (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.62.120.34
country_id: 2921044
description:
Jun 25 19:46:23 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.62.120.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.16.149.28
country_id: 6252001
description:
[2026-06-25 19:47:18 +0000] info [cpaneld] 76.16.149.28 - tontone "GET /login/?login_only=1&user=tontone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.35.31.167
country_id: 6252001
description:
[2026-06-25 19:47:12 +0000] info [cpaneld] 71.35.31.167 - tontonedouardtogocom "GET /login/?login_only=1&user=tontonedouardtogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedouardtogocom (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.16.157
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:167.253.16.157||TA:167.253.16.157||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.220.254.58
country_id: 6252001
description:
[2026-06-25 19:47:07 +0000] info [cpaneld] 98.220.254.58 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:48:03 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:48:03 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:48:22 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.39.236.98
country_id: 6252001
description:
[2026-06-25 19:48:22 +0000] info [cpaneld] 96.39.236.98 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.181.36
country_id: 6252001
description:
[2026-06-25 19:47:28 +0000] info [cpaneld] 172.58.181.36 - tont "GET /login/?login_only=1&user=tont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.250.120.19
country_id: 6252001
description:
[2026-06-25 19:48:03 +0000] info [cpaneld] 98.250.120.19 - benatextg "GET /login/?login_only=1&user=benatextg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benatextg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:48:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11598: 535 Incorrect authentication data (set_id=quan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:48:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56888: 535 Incorrect authentication data (set_id=packet@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.104.251.127
country_id: 6252001
description:
[2026-06-25 19:48:11 +0000] info [cpaneld] 174.104.251.127 - benat "GET /login/?login_only=1&user=benat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.29.55
country_id: 6252001
description:
[2026-06-25 19:48:16 +0000] info [cpaneld] 172.59.29.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.92.89.72
country_id: 6252001
description:
[2026-06-25 19:47:33 +0000] info [cpaneld] 72.92.89.72 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:48:50 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:48:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15392: 535 Incorrect authentication data (set_id=date@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:48:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39652: 535 Incorrect authentication data (set_id=oc@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.174.69.184
country_id: 6252001
description:
[2026-06-25 19:48:24 +0000] info [cpaneld] 67.174.69.184 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.160.26.176
country_id: 6252001
description:
[2026-06-25 19:48:27 +0000] info [cpaneld] 147.160.26.176 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:48:29 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:48:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37078: 535 Incorrect authentication data (set_id=packet@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:48:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40232: 535 Incorrect authentication data (set_id=fed@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.212.148.78
country_id: 6252001
description:
[2026-06-25 19:48:32 +0000] info [cpaneld] 73.212.148.78 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:48:35 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.241.34.17
country_id: 6252001
description:
[2026-06-25 19:49:39 +0000] info [cpaneld] 75.241.34.17 - ucoanger "GET /login/?login_only=1&user=ucoanger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoanger (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:49:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42746: 535 Incorrect authentication data (set_id=drukarka@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.210.141.128
country_id: 6252001
description:
[2026-06-25 19:49:36 +0000] info [cpaneld] 47.210.141.128 - ucoangerstg "GET /login/?login_only=1&user=ucoangerstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangerstg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:49:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56288: 535 Incorrect authentication data (set_id=despatch@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:49:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52892: 535 Incorrect authentication data (set_id=bo@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.143.237.119
country_id: 6252001
description:
[2026-06-25 19:49:33 +0000] info [cpaneld] 38.143.237.119 - ucoangers "GET /login/?login_only=1&user=ucoangers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangers (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:49:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9552: 535 Incorrect authentication data (set_id=sharefile@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:49:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:49:37 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:49:22 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:50:27 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:50:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:50:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38462: 535 Incorrect authentication data (set_id=sekretariat@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:50:47 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:50:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33582: 535 Incorrect authentication data (set_id=bz@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:51:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8808: 535 Incorrect authentication data (set_id=sys003@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:50:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33324: 535 Incorrect authentication data (set_id=switchboard@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:50:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5034: 535 Incorrect authentication data (set_id=traffic@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:51:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9634: 535 Incorrect authentication data (set_id=smb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:51:35 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:51:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:6722: 535 Incorrect authentication data (set_id=i5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:51:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:51:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9798: 535 Incorrect authentication data (set_id=kelli@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:51:53 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:51:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13822: 535 Incorrect authentication data (set_id=sale@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.253.101.115
country_id: 2017370
description:
[2026-06-25 19:52:40 +0000] info [cpaneld] 185.253.101.115 - ekinamagtg "GET /login/?login_only=1&user=ekinamagtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamagtg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:52:41 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:52:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62818: 535 Incorrect authentication data (set_id=aip@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.136.141.219
country_id: 1733045
description:
[2026-06-25 19:53:03 +0000] info [cpaneld] 175.136.141.219 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:52:23 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:52:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:52:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12860: 535 Incorrect authentication data (set_id=controller@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.26.184.232
country_id: 3686110
description:
[2026-06-25 19:52:43 +0000] info [cpaneld] 190.26.184.232 - ekinama "GET /login/?login_only=1&user=ekinama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinama (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [25/Jun/2026:19:52:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316401&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782417165 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.112.59
country_id: 3865483
description:
[2026-06-25 19:53:00 +0000] info [cpaneld] 181.209.112.59 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.156.4.116
country_id: 1562822
description:
[2026-06-25 19:52:37 +0000] info [cpaneld] 103.156.4.116 - ekinamag "GET /login/?login_only=1&user=ekinamag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.11.165.13
country_id: 3469034
description:
[2026-06-25 19:52:49 +0000] info [cpaneld] 177.11.165.13 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:52:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22322: 535 Incorrect authentication data (set_id=pharmacy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:52:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47526: 535 Incorrect authentication data (set_id=elizabeth@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:53:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2898: 535 Incorrect authentication data (set_id=sandhya@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53680: 535 Incorrect authentication data (set_id=prepay@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 19:53:27 +0000] info [cpaneld] 102.54.238.57 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:53:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2196: 535 Incorrect authentication data (set_id=ads3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:53:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:53:27 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:53:27 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:53:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19920: 535 Incorrect authentication data (set_id=ansi@ns5.netmaster.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.132.108.90
country_id: 1819730
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/la-securite-des-aeronefs-une-priorite-pour-la-salt/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:54:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15500: 535 Incorrect authentication data (set_id=plesk@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:54:58 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:55:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19318: 535 Incorrect authentication data (set_id=diana@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:54:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:54:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43632: 535 Incorrect authentication data (set_id=plesk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:54:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48704: 535 Incorrect authentication data (set_id=marketing@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:54:27 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:54:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43836: 535 Incorrect authentication data (set_id=seaney@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:55:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46862: 535 Incorrect authentication data (set_id=agro@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.113.65.99
country_id: 6252001
description:
[2026-06-25 19:55:44 +0000] info [cpaneld] 68.113.65.99 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.216.226.252
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.216.226.252: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:55:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56168: 535 Incorrect authentication data (set_id=synfuels@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.175
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.175: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.222.66.90
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.222.66.90: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.222.66.80
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.222.66.80: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.222.66.69
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.222.66.69: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:55:47 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:55:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60112: 535 Incorrect authentication data (set_id=sujata@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.46.237
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.46.237: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:55:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:55:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.0
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.0: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.198.73.236
country_id: 6252001
description:
[2026-06-25 19:55:49 +0000] info [cpaneld] 72.198.73.236 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.104.60
country_id: 6252001
description:
[2026-06-25 19:55:52 +0000] info [cpaneld] 172.59.104.60 - kpmgtg "GET /login/?login_only=1&user=kpmgtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpmgtg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:55:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16954: 535 Incorrect authentication data (set_id=server33@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:56:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:56:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53912: 535 Incorrect authentication data (set_id=enquete@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.121.214.80
country_id: 2542007
description:
[2026-06-25 19:56:44 +0000] info [cpaneld] 196.121.214.80 - nstrea "GET /login/?login_only=1&user=nstrea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstrea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.15.124.114
country_id: 3469034
description:
[2026-06-25 19:56:49 +0000] info [cpaneld] 189.15.124.114 - nstre "GET /login/?login_only=1&user=nstre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.195.253
country_id: 99237
description:
[2026-06-25 19:56:53 +0000] info [cpaneld] 185.56.195.253 - nstr "GET /login/?login_only=1&user=nstr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.108.159.214
country_id: 6252001
description:
[2026-06-25 19:57:06 +0000] info [cpaneld] 73.108.159.214 - leadellestg "GET /login/?login_only=1&user=leadellestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadellestg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:56:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23040: 535 Incorrect authentication data (set_id=kaitlin@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.131.172.111
country_id: 2635167
description:
[2026-06-25 19:56:41 +0000] info [cpaneld] 81.131.172.111 - nstream "GET /login/?login_only=1&user=nstream&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:56:50 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-25 19:57:14 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49194: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:56:35 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:56:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8968: 535 Incorrect authentication data (set_id=testvpn@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.82.49
country_id: 3469034
description:
[2026-06-25 19:56:35 +0000] info [cpaneld] 177.124.82.49 - nstreamp "GET /login/?login_only=1&user=nstreamp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.114.86
country_id: 2542007
description:
[2026-06-25 19:56:57 +0000] info [cpaneld] 41.141.114.86 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:56:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36650: 535 Incorrect authentication data (set_id=kasper@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.29.61
country_id: 3932488
description:
[2026-06-25 19:57:00 +0000] info [cpaneld] 179.6.29.61 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.62.161.10
country_id: 6252001
description:
[2026-06-25 19:57:03 +0000] info [cpaneld] 68.62.161.10 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.204.54.63
country_id: 6252001
description:
[2026-06-25 19:57:53 +0000] info [cpaneld] 75.204.54.63 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [25/Jun/2026:19:57:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6463133&pdata=http%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782417445 HTTP/1.1" 302 0 togosem.com "http://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:57:35 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:57:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12736: 535 Incorrect authentication data (set_id=patata@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.71.214.216
country_id: 6252001
description:
34.71.214.216 - - [25/Jun/2026:19:57:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066586&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782417446 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.71.214.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:57:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48844: 535 Incorrect authentication data (set_id=scanner2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:57:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.104.138
country_id: 6252001
description:
[2026-06-25 19:57:40 +0000] info [cpaneld] 172.59.104.138 - togocarrieretsevie "GET /login/?login_only=1&user=togocarrieretsevie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevie (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:57:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39920: 535 Incorrect authentication data (set_id=bkupexec@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.217.25.24
country_id: 6252001
description:
[2026-06-25 19:57:27 +0000] info [cpaneld] 24.217.25.24 - lea "GET /login/?login_only=1&user=lea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.188.103.31
country_id: 6252001
description:
[2026-06-25 19:57:37 +0000] info [cpaneld] 71.188.103.31 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.205.133.78
country_id: 6252001
description:
[2026-06-25 19:57:46 +0000] info [cpaneld] 74.205.133.78 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.182.63
country_id: 3190538
description:
[2026-06-25 19:58:06 +0000] info [webmaild] 130.12.182.63 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.248.171.23
country_id: 2750405
description:
89.248.171.23 - - [25/Jun/2026:19:58:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199811&pdata=http%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782417493 HTTP/1.1" 302 0 togosem.com "http://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.248.171.23


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:57:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13036: 535 Incorrect authentication data (set_id=bkupexec@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:57:22 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:57:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30150: 535 Incorrect authentication data (set_id=mahana@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.56.213.64
country_id: 6252001
description:
[2026-06-25 19:57:22 +0000] info [cpaneld] 108.56.213.64 - leade "GET /login/?login_only=1&user=leade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leade (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:58:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61910: 535 Incorrect authentication data (set_id=pod@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:58:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:58:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29932: 535 Incorrect authentication data (set_id=cavalrydesign@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.247.239.175
country_id: 6252001
description:
[2026-06-25 19:59:16 +0000] info [cpaneld] 216.247.239.175 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:58:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33358: 535 Incorrect authentication data (set_id=blackboard@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:58:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51166: 535 Incorrect authentication data (set_id=denis@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:58:55 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.77.184.45
country_id: 6252001
description:
[2026-06-25 19:59:14 +0000] info [cpaneld] 73.77.184.45 - med "GET /login/?login_only=1&user=med&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user med (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.184.238.23
country_id: 6252001
description:
[2026-06-25 19:59:05 +0000] info [cpaneld] 192.184.238.23 - mediat "GET /login/?login_only=1&user=mediat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:58:37 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 19:59:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4054: 535 Incorrect authentication data (set_id=`The@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 19:59:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43288: 535 Incorrect authentication data (set_id=cpr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 19:59:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27550: 535 Incorrect authentication data (set_id=merchant@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:59:22 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:59:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:59:40 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 19:59:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9602: 535 Incorrect authentication data (set_id=ui@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:01:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60506: 535 Incorrect authentication data (set_id=timothy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:00:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:00:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64412: 535 Incorrect authentication data (set_id=yoshi@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.93.170
country_id: 6252001
domain: ameak.co
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:142.111.93.170||TA:142.111.93.170||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.16.35.184
country_id: 6252001
description:
[2026-06-25 20:00:30 +0000] info [cpaneld] 173.16.35.184 - dagl "GET /login/?login_only=1&user=dagl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagl (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:00:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:00:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.40.149.201
country_id: 6252001
description:
[2026-06-25 20:00:34 +0000] info [cpaneld] 98.40.149.201 - dagltg "GET /login/?login_only=1&user=dagltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.126.149.126
country_id: 6252001
description:
[2026-06-25 20:00:43 +0000] info [cpaneld] 24.126.149.126 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:00:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47186: 535 Incorrect authentication data (set_id=mii@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.46.173.96
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.46.173.96: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.146.23
country_id: 6252001
description:
[2026-06-25 20:00:39 +0000] info [cpaneld] 70.170.146.23 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 88.198.139.2
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 88.198.139.2: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.46.173.78
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.46.173.78: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.145
country_id: 6252001
description:
[2026-06-25 20:01:12 +0000] info [cpaneld] 173.211.88.145 NEW wcnyaruu:SwHRSSiAr0_vxKeU address=173.211.88.145,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.46.161.16
country_id: 6252001
description:
[2026-06-25 20:01:10 +0000] info [cpaneld] 73.46.161.16 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-25 20:01:14 +0000] info [cpaneld] 5.230.153.169 NEW wcnyaruu:8QUeyHpJRQgrHKva address=5.230.153.169,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.102.104
country_id: 458258
domain: sncom.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:45.131.102.104||TA:45.131.102.104||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.46.173.81
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.46.173.81: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:00:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44158: 535 Incorrect authentication data (set_id=jm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.160
country_id: 1733045
description:
2026-06-25 20:00:35 dovecot_login authenticator failed for H=([183.171.7.160]) [183.171.7.160]:46200: 535 Incorrect authentication data (set_id=waphf@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:00:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46874: 535 Incorrect authentication data (set_id=ghenry@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.62.198.131
country_id: 1733045
description:
Jun 25 20:00:56 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.62.198.131 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 88.198.139.31
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 88.198.139.31: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.46.173.79
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.46.173.79: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:01:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28768: 535 Incorrect authentication data (set_id=srm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:01:37 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:02:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64396: 535 Incorrect authentication data (set_id=terapia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:01:35 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:01:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23118: 535 Incorrect authentication data (set_id=tienda@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:01:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56092: 535 Incorrect authentication data (set_id=gigi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:01:58 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:02:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43606: 535 Incorrect authentication data (set_id=beverage@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:02:28 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:02:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61570: 535 Incorrect authentication data (set_id=123@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.228.20
country_id: 6252001
description:
[2026-06-25 20:02:32 +0000] info [cpaneld] 73.162.228.20 - catogo "GET /login/?login_only=1&user=catogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.8.51.201
country_id: 6252001
description:
[2026-06-25 20:02:42 +0000] info [cpaneld] 73.8.51.201 - cat "GET /login/?login_only=1&user=cat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:02:44 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.145.230.84
country_id: 6252001
description:
[2026-06-25 20:02:45 +0000] info [cpaneld] 73.145.230.84 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:02:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35708: 535 Incorrect authentication data (set_id=donald@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.186.235.32
country_id: 6252001
description:
[2026-06-25 20:02:34 +0000] info [cpaneld] 66.186.235.32 - catogoorg "GET /login/?login_only=1&user=catogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catogoorg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:02:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:40828: 535 Incorrect authentication data (set_id=789456@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:02:48 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 25 20:02:25 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.16
country_id: 6252001
description:
47.251.188.16 - - [25/Jun/2026:20:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209684&pdata=https%253A%252F%252F154.70.82.244%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782417857 HTTP/2.0" 302 0 154.70.82.244 "https://154.70.82.244:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.234.86.244
country_id: 3437598
description:
[2026-06-25 20:03:58 +0000] info [cpaneld] 45.234.86.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.192.95
country_id: 1733045
description:
Jun 25 20:04:00 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.192.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:03:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11456: 535 Incorrect authentication data (set_id=paris@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:03:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16514: 535 Incorrect authentication data (set_id=elementor@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.39.202
country_id: 6252001
description:
[2026-06-25 20:03:58 +0000] info [cpaneld] 73.207.39.202 - ekeasarlcom "GET /login/?login_only=1&user=ekeasarlcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarlcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.186.38.119
country_id: 6252001
description:
[2026-06-25 20:04:05 +0000] info [cpaneld] 98.186.38.119 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:03:30 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.245.60.84
country_id: 6252001
description:
[2026-06-25 20:04:01 +0000] info [cpaneld] 162.245.60.84 - ekeasar "GET /login/?login_only=1&user=ekeasar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasar (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:03:39 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.215.75.80
country_id: 6252001
description:
[2026-06-25 20:04:14 +0000] info [cpaneld] 73.215.75.80 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:03:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33964: 535 Incorrect authentication data (set_id=yakutsk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:03:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17060: 535 Incorrect authentication data (set_id=jms@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.33.122
country_id: 3658394
description:
[2026-06-25 20:04:03 +0000] info [cpaneld] 185.181.33.122 - davakconsulting "GET /login/?login_only=1&user=davakconsulting&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulting (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.184.74.134
country_id: 3469034
description:
[2026-06-25 20:04:18 +0000] info [cpaneld] 177.184.74.134 - davakc "GET /login/?login_only=1&user=davakc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:03:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.254.143.77
country_id: 6252001
description:
[2026-06-25 20:03:50 +0000] info [cpaneld] 73.254.143.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.237.80.223
country_id: 298795
description:
[2026-06-25 20:04:32 +0000] info [cpaneld] 88.237.80.223 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.163.20.216
country_id: 2921044
description:
[2026-06-25 20:04:24 +0000] info [cpaneld] 84.163.20.216 - dava "GET /login/?login_only=1&user=dava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dava (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:04:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57286: 535 Incorrect authentication data (set_id=map@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:04:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63032: 535 Incorrect authentication data (set_id=shitting@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:04:23 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:04:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:04:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:04:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23492: 535 Incorrect authentication data (set_id=kwilliams@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:04:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:60778: 535 Incorrect authentication data (set_id=kwilliams@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jun 25 20:04:23 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.126.84
country_id: 6252001
description:
[2026-06-25 20:04:22 +0000] info [cpaneld] 172.58.126.84 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:04:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62888: 535 Incorrect authentication data (set_id=search.library@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:05:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13286: 535 Incorrect authentication data (set_id=secretaria@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:05:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47576: 535 Incorrect authentication data (set_id=dns3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:05:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39538: 535 Incorrect authentication data (set_id=laborator@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:05:41 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:05:48 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:05:30 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:05:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:31496: 535 Incorrect authentication data (set_id=test010@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:06:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3790: 535 Incorrect authentication data (set_id=katherine@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.101.92.127
country_id: 6252001
description:
[2026-06-25 20:07:01 +0000] info [cpaneld] 68.101.92.127 - confo "GET /login/?login_only=1&user=confo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.24.144.240
country_id: 6252001
description:
[2026-06-25 20:07:01 +0000] info [cpaneld] 24.24.144.240 - mediatopnewstg "GET /login/?login_only=1&user=mediatopnewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.125.227.240
country_id: 6252001
description:
[2026-06-25 20:06:57 +0000] info [cpaneld] 24.125.227.240 - confor "GET /login/?login_only=1&user=confor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.103.38.223
country_id: 6252001
description:
[2026-06-25 20:07:08 +0000] info [cpaneld] 97.103.38.223 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:06:38 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.132.195.167
country_id: 6252001
description:
[2026-06-25 20:06:54 +0000] info [cpaneld] 73.132.195.167 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.134.136
country_id: 6252001
description:
[2026-06-25 20:06:45 +0000] info [cpaneld] 47.141.134.136 - confortistg "GET /login/?login_only=1&user=confortistg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortistg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.225.20.47
country_id: 6252001
description:
[2026-06-25 20:06:49 +0000] info [cpaneld] 24.225.20.47 - conforti "GET /login/?login_only=1&user=conforti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conforti (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:06:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:06:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51260: 535 Incorrect authentication data (set_id=sebast@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:06:53 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:06:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43842: 535 Incorrect authentication data (set_id=arthur@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.27
country_id: 1880251
description:
43.173.174.27 - - [25/Jun/2026:20:06:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13144932&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F57661&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782418006 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/57661" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.27


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:06:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50714: 535 Incorrect authentication data (set_id=mon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:07:23 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 20:07:27 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:07:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26910: 535 Incorrect authentication data (set_id=melanie@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:07:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6510: 535 Incorrect authentication data (set_id=melanie@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.11.181.148
country_id: 3175395
description:
87.11.181.148 - - [25/Jun/2026:20:07:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171987&pdata=https%253A%252F%252Fwebmail.techinoov.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782418066 HTTP/2.0" 302 0 webmail.techinoov.free.netmaster.tg "https://webmail.techinoov.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.11.181.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:07:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:44632: 535 Incorrect authentication data (set_id=karen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:07:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64574: 535 Incorrect authentication data (set_id=devphp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:07:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:07:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:60958: 535 Incorrect authentication data (set_id=ddns@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.172.248.34
country_id: 2750405
description:
81.172.248.34 - - [25/Jun/2026:20:08:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806805&pdata=http%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782418115 HTTP/1.1" 302 0 togosem.com "http://togosem.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.172.248.34


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.185.170.112
country_id: 6252001
description:
[2026-06-25 20:08:36 +0000] info [cpaneld] 73.185.170.112 - lcttog "GET /login/?login_only=1&user=lcttog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcttog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.219.129
country_id: 294640
description:
[2026-06-25 20:08:56 +0000] info [cpaneld] 147.235.219.129 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 137.83.128.155
country_id: 2510769
description:
Denial of Service (DoS) attack was discovered from 137.83.128.155: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:08:22 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:08:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47330: 535 Incorrect authentication data (set_id=cv@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.105.100.84
country_id: 6252001
description:
[2026-06-25 20:08:50 +0000] info [cpaneld] 174.105.100.84 - lc "GET /login/?login_only=1&user=lc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:08:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36980: 535 Incorrect authentication data (set_id=jesslyn@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.98.100.170
country_id: 6252001
description:
[2026-06-25 20:08:44 +0000] info [cpaneld] 16.98.100.170 - lctt "GET /login/?login_only=1&user=lctt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lctt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.8.238
country_id: 6252001
description:
[2026-06-25 20:09:15 +0000] info [cpaneld] 172.56.8.238 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:08:32 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.10.10.123
country_id: 3469034
description:
[2026-06-25 20:08:46 +0000] info [cpaneld] 177.10.10.123 - cecaptg "GET /login/?login_only=1&user=cecaptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecaptg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:08:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44708: 535 Incorrect authentication data (set_id=hjd@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.236.188.67
country_id: 3932488
description:
[2026-06-25 20:08:54 +0000] info [cpaneld] 38.236.188.67 - cec "GET /login/?login_only=1&user=cec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cec (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:08:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9044: 535 Incorrect authentication data (set_id=edinburgh@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.195.11
country_id: 6252001
description:
[2026-06-25 20:09:36 +0000] info [cpaneld] 173.68.195.11 - cenitog "GET /login/?login_only=1&user=cenitog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:09:52 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.90.157.137
country_id: 3017382
description:
[2026-06-25 20:10:07 +0000] info [cpaneld] 89.90.157.137 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.244.211.48
country_id: 1562822
description:
[2026-06-25 20:10:20 +0000] info [cpaneld] 14.244.211.48 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.13.126
country_id: 3932488
description:
[2026-06-25 20:09:48 +0000] info [cpaneld] 179.6.13.126 - togocarrieretsevie "GET /login/?login_only=1&user=togocarrieretsevie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:09:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20204: 535 Incorrect authentication data (set_id=rat@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 20:09:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.105.125.47
country_id: 6252001
description:
[2026-06-25 20:09:28 +0000] info [cpaneld] 73.105.125.47 - saha "GET /login/?login_only=1&user=saha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saha (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:09:30 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.161.189.104
country_id: 6252001
description:
[2026-06-25 20:09:31 +0000] info [cpaneld] 73.161.189.104 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:09:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:21116: 535 Incorrect authentication data (set_id=pride@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.48.223.133
country_id: 1733045
description:
[2026-06-25 20:09:45 +0000] info [cpaneld] 60.48.223.133 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:09:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13266: 535 Incorrect authentication data (set_id=developer@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.107.59
country_id: 290291
description:
[2026-06-25 20:09:57 +0000] info [cpaneld] 88.201.107.59 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.137.231
country_id: 6252001
description:
[2026-06-25 20:09:45 +0000] info [cpaneld] 172.59.137.231 - cenit "GET /login/?login_only=1&user=cenit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.25.77.155
country_id: 2921044
description:
[2026-06-25 20:10:04 +0000] info [cpaneld] 178.25.77.155 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:09:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41818: 535 Incorrect authentication data (set_id=n3@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.19.130.242
country_id: 3469034
description:
[2026-06-25 20:10:01 +0000] info [cpaneld] 187.19.130.242 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-25 20:10:22 +0000] info [cpaneld] 134.195.82.52 NEW wcnyaruu:q253MWgL38ZEJiWj address=134.195.82.52,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:10:28 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.157.112.61
country_id: 3017382
description:
45.157.112.61 - - [25/Jun/2026:20:10:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867054&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782418230 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.157.112.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:10:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2402: 535 Incorrect authentication data (set_id=mgutierrez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:10:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14240: 535 Incorrect authentication data (set_id=computer@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:10:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61964: 535 Incorrect authentication data (set_id=aquile@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:10:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:10:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60978: 535 Incorrect authentication data (set_id=career@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:10:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30506: 535 Incorrect authentication data (set_id=mgutierrez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:11:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42870: 535 Incorrect authentication data (set_id=aachen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:11:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16820: 535 Incorrect authentication data (set_id=fitness@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:11:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43246: 535 Incorrect authentication data (set_id=like@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.34.22.157
country_id: 6252001
description:
[2026-06-25 20:11:42 +0000] info [cpaneld] 71.34.22.157 - sotr "GET /login/?login_only=1&user=sotr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.182.227.245
country_id: 6252001
description:
[2026-06-25 20:11:47 +0000] info [cpaneld] 71.182.227.245 - cecaptg "GET /login/?login_only=1&user=cecaptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecaptg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:11:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43198: 535 Incorrect authentication data (set_id=promotions@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:11:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.41.21.242
country_id: 6252001
description:
[2026-06-25 20:11:39 +0000] info [cpaneld] 108.41.21.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.11.151.82
country_id: 6252001
description:
[2026-06-25 20:11:23 +0000] info [cpaneld] 107.11.151.82 - sotranetogo "GET /login/?login_only=1&user=sotranetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.29.200
country_id: 6252001
description:
[2026-06-25 20:11:49 +0000] info [cpaneld] 71.187.29.200 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.187.105.226
country_id: 6252001
description:
[2026-06-25 20:11:51 +0000] info [cpaneld] 97.187.105.226 - ceca "GET /login/?login_only=1&user=ceca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.137.58
country_id: 6252001
description:
[2026-06-25 20:11:26 +0000] info [cpaneld] 172.59.137.58 - sotranetogocom "GET /login/?login_only=1&user=sotranetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogocom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:11:32 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.244.11.146
country_id: 1269750
description:
185.244.11.146 - - [25/Jun/2026:20:13:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739115&pdata=https%253A%252F%252Ftogomedia24.tg%252F2025%252F06%252F07%252Fdans-un-climat-tendu-wanep-appel-a-la-responsabilite-individuelle-et-collective-envers-le-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782418388 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2025/06/07/dans-un-climat-tendu-wanep-appel-a-la-responsabilite-individuelle-et-collective-envers-le-togo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.5298.1645 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.244.11.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.97.235.246
country_id: 6252001
description:
[2026-06-25 20:13:05 +0000] info [cpaneld] 66.97.235.246 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: modsec
rule: 77140883
name: IM360 WAF: RBL track known shells
abuser: 138.226.20.54
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: RBL track known shells||MVN:ARGS:path||RSV:8.20||T:APACHE||ARGS.path:/vape-guide/uk/guides/genericdisposableinformationuk-7/en||ARGS.url:https://cloud-et-racks.tg/vape-guide/uk/guides/genericdisposableinformationuk-7/en||SC:/home/cloudetracks/public_html/stats.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.190.123.0
country_id: 3686110
description:
[2026-06-25 20:13:10 +0000] info [cpaneld] 38.190.123.0 - best "GET /login/?login_only=1&user=best&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user best (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:12:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:12:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11076: 535 Incorrect authentication data (set_id=s4@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.3.171.174
country_id: 298795
description:
[2026-06-25 20:12:47 +0000] info [cpaneld] 188.3.171.174 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:12:50 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.28.86.105
country_id: 3686110
description:
[2026-06-25 20:12:51 +0000] info [cpaneld] 190.28.86.105 - besteva1 "GET /login/?login_only=1&user=besteva1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.118.152.219
country_id: 3686110
description:
[2026-06-25 20:13:13 +0000] info [cpaneld] 181.118.152.219 - bes "GET /login/?login_only=1&user=bes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:12:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55410: 535 Incorrect authentication data (set_id=girasoles@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.96.77.179
country_id: 1562822
description:
[2026-06-25 20:12:56 +0000] info [cpaneld] 116.96.77.179 - besteva1com "GET /login/?login_only=1&user=besteva1com&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva1com (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.232.64.238
country_id: 2017370
description:
[2026-06-25 20:12:59 +0000] info [cpaneld] 188.232.64.238 - besteva "GET /login/?login_only=1&user=besteva&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.200.62.17
country_id: 6252001
description:
[2026-06-25 20:13:08 +0000] info [cpaneld] 71.200.62.17 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57514: 535 Incorrect authentication data (set_id=johndoe@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:12:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47792: 535 Incorrect authentication data (set_id=love@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.31.107.137
country_id: 6252001
description:
[2026-06-25 20:12:58 +0000] info [cpaneld] 108.31.107.137 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.246.190
country_id: 3996063
description:
[2026-06-25 20:13:02 +0000] info [cpaneld] 187.189.246.190 - bestev "GET /login/?login_only=1&user=bestev&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bestev (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:13:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30202: 535 Incorrect authentication data (set_id=itsm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:13:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31732: 535 Incorrect authentication data (set_id=button@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.126.55.242
country_id: 6252001
description:
[2026-06-25 20:14:03 +0000] info [cpaneld] 73.126.55.242 - digilixtg "GET /login/?login_only=1&user=digilixtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digilixtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.179.119
country_id: 6252001
description:
[2026-06-25 20:14:09 +0000] info [cpaneld] 153.66.179.119 - digil "GET /login/?login_only=1&user=digil&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digil (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 25 20:14:12 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.248.13.192
country_id: 6252001
description:
[2026-06-25 20:14:06 +0000] info [cpaneld] 69.248.13.192 - digili "GET /login/?login_only=1&user=digili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digili (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24194: 535 Incorrect authentication data (set_id=avg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:13:32 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:13:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47892: 535 Incorrect authentication data (set_id=coleen@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.221
country_id: 2300660
description:
Jun 25 20:13:57 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:13:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64936: 535 Incorrect authentication data (set_id=marketplace@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.100.6.109
country_id: 6252001
description:
[2026-06-25 20:14:19 +0000] info [cpaneld] 174.100.6.109 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:13:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 25 20:13:41 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.105.17.196
country_id: 6252001
description:
[2026-06-25 20:13:55 +0000] info [cpaneld] 174.105.17.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:14:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50474: 535 Incorrect authentication data (set_id=laser1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:14:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12320: 535 Incorrect authentication data (set_id=avg@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.13.153
country_id: 6252001
description:
[2026-06-25 20:15:19 +0000] info [cpaneld] 184.164.13.153 - zontal "GET /login/?login_only=1&user=zontal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.47.235
country_id: 6252001
description:
[2026-06-25 20:15:05 +0000] info [cpaneld] 73.226.47.235 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:14:35 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:14:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41168: 535 Incorrect authentication data (set_id=futbol@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.197.182.23
country_id: 6252001
description:
[2026-06-25 20:15:00 +0000] info [cpaneld] 67.197.182.23 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:14:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.185.247.153
country_id: 6252001
description:
[2026-06-25 20:14:54 +0000] info [cpaneld] 184.185.247.153 - cenitog "GET /login/?login_only=1&user=cenitog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitog (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:14:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44972: 535 Incorrect authentication data (set_id=pantera@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:15:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17036: 535 Incorrect authentication data (set_id=orid@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:15:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23246: 535 Incorrect authentication data (set_id=katja@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:15:51 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.134.91.182
country_id: 6252001
description:
[2026-06-25 20:15:28 +0000] info [cpaneld] 68.134.91.182 - zon "GET /login/?login_only=1&user=zon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.80.249.34
country_id: 6252001
description:
[2026-06-25 20:15:31 +0000] info [cpaneld] 158.80.249.34 - zo "GET /login/?login_only=1&user=zo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:15:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 25 20:15:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:15:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:44872: 535 Incorrect authentication data (set_id=ro@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:15:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25014: 535 Incorrect authentication data (set_id=vector5@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.145.94.45
country_id: 6252001
description:
[2026-06-25 20:15:25 +0000] info [cpaneld] 107.145.94.45 - zont "GET /login/?login_only=1&user=zont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zont (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:16:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63882: 535 Incorrect authentication data (set_id=ct@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:16:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21232: 535 Incorrect authentication data (set_id=local@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:17:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34170: 535 Incorrect authentication data (set_id=kosei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:16:25 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:16:37 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:16:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1306: 535 Incorrect authentication data (set_id=tsm@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.109.107
country_id: 6252001
description:
[2026-06-25 20:18:15 +0000] info [cpaneld] 172.59.109.107 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:17:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:17:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:17:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46994: 535 Incorrect authentication data (set_id=test999@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:17:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46332: 535 Incorrect authentication data (set_id=willie@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.50.158.3
country_id: 6252001
description:
[2026-06-25 20:18:07 +0000] info [cpaneld] 68.50.158.3 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:17:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40022: 535 Incorrect authentication data (set_id=fileshare@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:17:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58260: 535 Incorrect authentication data (set_id=ns113@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.226.66.76
country_id: 3996063
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/macite.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.52.167.62
country_id: 6252001
description:
[2026-06-25 20:18:19 +0000] info [cpaneld] 173.52.167.62 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:17:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42040: 535 Incorrect authentication data (set_id=db02@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:18:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60390: 535 Incorrect authentication data (set_id=sunrise@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:18:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22600: 535 Incorrect authentication data (set_id=dim@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.6.179
country_id: 6252001
description:
[2026-06-25 20:18:31 +0000] info [cpaneld] 195.63.6.179 - doufelg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.54.51.202
country_id: 6252001
description:
[2026-06-25 20:18:45 +0000] info [cpaneld] 174.54.51.202 - np "GET /login/?login_only=1&user=np&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user np (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:18:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31602: 535 Incorrect authentication data (set_id=mech@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:18:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50828: 535 Incorrect authentication data (set_id=abcde12345@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:18:24 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.25.219
country_id: 3469034
description:
Jun 25 20:18:53 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.25.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 220.134.28.74
country_id: 1668284
description:
[2026-06-25 20:19:42 +0000] info [cpaneld] 220.134.28.74 - unive "GET /login/?login_only=1&user=unive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user unive (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:19:43 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.56.226.224
country_id: 6252001
description:
[2026-06-25 20:20:00 +0000] info [cpaneld] 98.56.226.224 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:19:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63544: 535 Incorrect authentication data (set_id=kangpo@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.7.64.89
country_id: 3932488
description:
[2026-06-25 20:19:25 +0000] info [cpaneld] 179.7.64.89 - universcomtg "GET /login/?login_only=1&user=universcomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.22.145.127
country_id: 2017370
description:
[2026-06-25 20:19:36 +0000] info [cpaneld] 89.22.145.127 - univer "GET /login/?login_only=1&user=univer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univer (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:19:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33238: 535 Incorrect authentication data (set_id=lnet@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:19:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35456: 535 Incorrect authentication data (set_id=gr@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.53
country_id: 6252001
description:
[2026-06-25 20:19:45 +0000] info [cpaneld] 195.63.9.53 - elmkvzcm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.12.103.46
country_id: 6252001
description:
[2026-06-25 20:20:04 +0000] info [cpaneld] 100.12.103.46 - nstreampro "GET /login/?login_only=1&user=nstreampro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreampro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.211.155.132
country_id: 3469034
description:
[2026-06-25 20:19:30 +0000] info [cpaneld] 38.211.155.132 - universc "GET /login/?login_only=1&user=universc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.146.240.209
country_id: 6252001
description:
[2026-06-25 20:19:44 +0000] info [cpaneld] 67.146.240.209 - creche "GET /login/?login_only=1&user=creche&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user creche (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.63.32.10
country_id: 6252001
description:
[2026-06-25 20:20:17 +0000] info [cpaneld] 136.63.32.10 - nstrea "GET /login/?login_only=1&user=nstrea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstrea (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:19:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55388: 535 Incorrect authentication data (set_id=hirose@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.195.78.144
country_id: 6252001
description:
[2026-06-25 20:19:32 +0000] info [cpaneld] 68.195.78.144 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.82.132.73
country_id: 3469034
description:
[2026-06-25 20:19:34 +0000] info [cpaneld] 177.82.132.73 - univers "GET /login/?login_only=1&user=univers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.56.5.127
country_id: 2921044
description:
[2026-06-25 20:19:59 +0000] info [cpaneld] 91.56.5.127 - un "GET /login/?login_only=1&user=un&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user un (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:19:28 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:20:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9546: 535 Incorrect authentication data (set_id=manuscript@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:20:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:20:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53718: 535 Incorrect authentication data (set_id=manuscript@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:20:28 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:20:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11790: 535 Incorrect authentication data (set_id=portail@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:20:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27932: 535 Incorrect authentication data (set_id=quaker@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:20:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43882: 535 Incorrect authentication data (set_id=yz@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 177.234.138.118
country_id: 1269750
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:177.234.138.118||TA:177.234.138.118||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.78.246.28
country_id: 6252001
description:
[2026-06-25 20:20:29 +0000] info [cpaneld] 72.78.246.28 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:21:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4274: 535 Incorrect authentication data (set_id=spider@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:21:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25118: 535 Incorrect authentication data (set_id=web10@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:21:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29948: 535 Incorrect authentication data (set_id=bernard@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.97.184.47
country_id: 290557
description:
[2026-06-25 20:21:40 +0000] info [cpaneld] 92.97.184.47 - horizonmedical "GET /login/?login_only=1&user=horizonmedical&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedical (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.119.186.43
country_id: 1210997
description:
[2026-06-25 20:21:57 +0000] info [cpaneld] 157.119.186.43 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.204.150.141
country_id: 2017370
description:
[2026-06-25 20:22:04 +0000] info [cpaneld] 91.204.150.141 - hor "GET /login/?login_only=1&user=hor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hor (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:21:21 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:21:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56406: 535 Incorrect authentication data (set_id=minou@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.230.33.12
country_id: 3686110
description:
[2026-06-25 20:21:36 +0000] info [cpaneld] 45.230.33.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.32.24.170
country_id: 3686110
description:
[2026-06-25 20:21:42 +0000] info [cpaneld] 181.32.24.170 - horizonmedicaltg "GET /login/?login_only=1&user=horizonmedicaltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedicaltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.128.145.202
country_id: 3469034
description:
[2026-06-25 20:21:46 +0000] info [cpaneld] 177.128.145.202 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.142.104.230
country_id: 2400553
description:
[2026-06-25 20:22:07 +0000] info [cpaneld] 102.142.104.230 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:21:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.61.242.210
country_id: 2017370
description:
[2026-06-25 20:21:51 +0000] info [cpaneld] 46.61.242.210 - horizo "GET /login/?login_only=1&user=horizo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:22:49 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.10.118
country_id: 6252001
description:
[2026-06-25 20:23:10 +0000] info [cpaneld] 172.56.10.118 - confortis "GET /login/?login_only=1&user=confortis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.14.135.128
country_id: 6252001
description:
[2026-06-25 20:23:14 +0000] info [cpaneld] 108.14.135.128 - togoathl "GET /login/?login_only=1&user=togoathl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:22:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5300: 535 Incorrect authentication data (set_id=confirm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:22:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33300: 535 Incorrect authentication data (set_id=dynamics@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:22:42 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:22:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:2932: 535 Incorrect authentication data (set_id=nsp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:22:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5492: 535 Incorrect authentication data (set_id=lllll@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.222.110
country_id: 6252001
description:
[2026-06-25 20:23:21 +0000] info [cpaneld] 68.40.222.110 - togoat "GET /login/?login_only=1&user=togoat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:23:35 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:23:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43712: 535 Incorrect authentication data (set_id=training1@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.90.216
country_id: 6252001
description:
[2026-06-25 20:23:39 +0000] info [cpaneld] 172.56.90.216 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:23:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22024: 535 Incorrect authentication data (set_id=joanne@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.195.128.244
country_id: 6252001
description:
[2026-06-25 20:23:24 +0000] info [cpaneld] 68.195.128.244 - confor "GET /login/?login_only=1&user=confor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.73.179
country_id: 6252001
description:
[2026-06-25 20:23:36 +0000] info [cpaneld] 47.149.73.179 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:23:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46362: 535 Incorrect authentication data (set_id=berenisthebest@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.179.235.248
country_id: 6252001
description:
[2026-06-25 20:23:24 +0000] info [cpaneld] 72.179.235.248 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:23:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.248.180
country_id: 6252001
description:
[2026-06-25 20:23:33 +0000] info [cpaneld] 153.66.248.180 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:23:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12854: 535 Incorrect authentication data (set_id=joanne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1788: 535 Incorrect authentication data (set_id=vehicle@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:24:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38772: 535 Incorrect authentication data (set_id=orgy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:24:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.75.187.10
country_id: 6252001
description:
[2026-06-25 20:24:57 +0000] info [cpaneld] 149.75.187.10 - ciieeinternational "GET /login/?login_only=1&user=ciieeinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternational (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:24:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22726: 535 Incorrect authentication data (set_id=networking@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:24:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53484: 535 Incorrect authentication data (set_id=f@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:24:32 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:24:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64054: 535 Incorrect authentication data (set_id=plural@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.232.235.99
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/la-ceni-se-prepare_i1920.jpg HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 20:25:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.178.14
country_id: 6252001
description:
[2026-06-25 20:25:25 +0000] info [cpaneld] 46.110.178.14 - ucoangers "GET /login/?login_only=1&user=ucoangers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.130.200.211
country_id: 6252001
description:
[2026-06-25 20:25:53 +0000] info [cpaneld] 74.130.200.211 - uco "GET /login/?login_only=1&user=uco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 20:25:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40374: 535 Incorrect authentication data (set_id=trial@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 20:25:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1470: 535 Incorrect authentication data (set_id=lawrence@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.62.162.226
country_id: 6252001
description:
[2026-06-25 20:25:43 +0000] info [cpaneld] 174.62.162.226 - ucoang "GET /login/?login_only=1&user=ucoang&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoang (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.35.169.193
country_id: 6252001
description:
[2026-06-25 20:25:34 +0000] info [cpaneld] 108.35.169.193 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.236.162.93
country_id: 6252001
description:
[2026-06-25 20:26:01 +0000] info [cpaneld] 75.236.162.93 - libe "GET /login/?login_only=1&user=libe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.62.48.169
country_id: 6252001
description:
[2026-06-25 20:25:53 +0000] info [cpaneld] 71.62.48.169 - libert "GET /login/?login_only=1&user=libert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libert (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 20:25:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3236: 535 Incorrect authentication data (set_id=piotrek@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.33.149.199
country_id: 6252001
description:
[2026-06-25 20:25:42 +0000] info [cpaneld] 136.33.149.199 - libertetogotg "GET /login/?login_only=1&user=libertetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogotg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 20:25:23 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 20:25:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63524: 535 Incorrect authentication data (set_id=agana@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.17.217.96
country_id: 6252001
description:
[2026-06-25 20:25:34 +0000] info [cpaneld] 47.17.217.96 - ucoanger "GET /login/?login_only=1&user=ucoanger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoanger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.168.247
country_id: 6252001
description:
[2026-06-25 20:25:39 +0000] info [cpaneld] 98.97.168.247 - libertetogo "GET /login/?login_only=1&user=libertetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.192.95
country_id: 1733045
description:
Jun 25 20:25:52 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.192.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.187.109
country_id: 2921044
description:
Jun 25 20:27:02 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.187.109 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.172.248.34
country_id: 2750405
description:
81.172.248.34 - - [25/Jun/2026:20:28:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004741&pdata=http%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782419305 HTTP/1.1" 302 0 togosem.com "http://togosem.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.172.248.34


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.4.39.192
country_id: 6252001
description:
[2026-06-25 20:29:20 +0000] info [cpaneld] 184.4.39.192 - metaarttg "GET /login/?login_only=1&user=metaarttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaarttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.123.200.17
country_id: 6252001
description:
[2026-06-25 20:29:42 +0000] info [cpaneld] 76.123.200.17 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 212.132.94.176
country_id: 2921044
description:
[2026-06-25 20:30:02 +0000] info [cpaneld] 212.132.94.176 NEW he24djure:dFdpSgyt0fmRh6BJ address=212.132.94.176,app=cpaneld,creator=he24djure,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.198.13.212
country_id: 241170
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:196.198.13.212||TA:196.198.13.212||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 20:34:13 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.253.206.123
country_id: 6252001
description:
[2026-06-25 20:36:11 +0000] info [cpaneld] 69.253.206.123 - daulatg "GET /login/?login_only=1&user=daulatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user daulatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.250.201.58
country_id: 6252001
description:
[2026-06-25 20:36:21 +0000] info [cpaneld] 172.250.201.58 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.198.10.72
country_id: 6252001
description:
[2026-06-25 20:36:32 +0000] info [cpaneld] 68.198.10.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.205.242
country_id: 6252001
description:
[2026-06-25 20:36:35 +0000] info [cpaneld] 71.38.205.242 - kfauto "GET /login/?login_only=1&user=kfauto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfauto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.248.3.29
country_id: 6252001
description:
[2026-06-25 20:36:52 +0000] info [cpaneld] 98.248.3.29 - kfa "GET /login/?login_only=1&user=kfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.22.110.90
country_id: 6252001
description:
[2026-06-25 20:38:01 +0000] info [cpaneld] 70.22.110.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.215.224.42
country_id: 6252001
description:
[2026-06-25 20:38:07 +0000] info [cpaneld] 98.215.224.42 - togodailynews "GET /login/?login_only=1&user=togodailynews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynews (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.204.12.244
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.72.232.121
country_id: 1210997
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:202.72.232.121||TA:202.72.232.121||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.26.234.194
country_id: 6252001
description:
[2026-06-25 20:38:25 +0000] info [cpaneld] 73.26.234.194 - togod "GET /login/?login_only=1&user=togod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togod (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.59.121.136
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.59.121.136: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.13.132.80
country_id: 1880251
description:
Jun 25 20:41:22 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.13.132.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.25.193.40
country_id: 2661886
description:
[2026-06-25 20:41:26 +0000] info [cpaneld] 171.25.193.40 - pjwfvzan "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.40
country_id: 2661886
description:
171.25.193.40 - pjwfvzan [25/Jun/2026:20:41:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197956&pdata=https%253A%252F%252Fauditeccandco.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420084 HTTP/2.0" 302 0 auditeccandco.com "https://auditeccandco.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.118.213.76
country_id: 3351879
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/senat-togo-barry-moussa-barque-rencontre-la-cedeao-et-loms/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.53.174.103
country_id: 630336
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.27.232
country_id: 2750405
description:
[2026-06-25 20:42:51 +0000] info [cpaneld] 195.63.27.232 - nadngfzn "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.160.203.195
country_id: 6252001
description:
[2026-06-25 20:43:14 +0000] info [cpaneld] 70.160.203.195 - fastsol "GET /login/?login_only=1&user=fastsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsol (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.118.213.76
country_id: 3351879
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/senat-togo-barry-moussa-barque-rencontre-la-cedeao-et-loms/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.196.81.188
country_id: 1814991
description:
2026-06-25 20:42:52 dovecot_plain authenticator failed for H=(wyhh1s7uxd27d9hi016p) [115.196.81.188]:42374: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.202.146.71
country_id: 6252001
description:
[2026-06-25 20:43:31 +0000] info [cpaneld] 47.202.146.71 - fas "GET /login/?login_only=1&user=fas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.225
country_id: 2635167
description:
[2026-06-25 20:43:52 +0000] info [cpaneld] 195.63.25.225 - dmmkifel "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.218
country_id: 2635167
description:
[2026-06-25 20:44:19 +0000] info [cpaneld] 217.181.93.218 - ljrwwgxg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.243.203
country_id: 2017370
description:
2026-06-25 20:43:28 dovecot_login authenticator failed for H=128-75-243-203.broadband.corbina.ru [128.75.243.203]:37282: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.74.238.76
country_id: 6252001
description:
[2026-06-25 20:43:43 +0000] info [cpaneld] 148.74.238.76 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.243.203
country_id: 2017370
description:
Jun 25 20:43:26 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.243.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.50.88.59
country_id: 6252001
description:
[2026-06-25 20:43:28 +0000] info [cpaneld] 136.50.88.59 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.154.34
country_id: 6252001
description:
[2026-06-25 20:43:45 +0000] info [cpaneld] 76.32.154.34 - whitewa "GET /login/?login_only=1&user=whitewa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whitewa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.68
country_id: 2635167
description:
[2026-06-25 20:44:00 +0000] info [cpaneld] 195.63.23.68 - himcuijv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.62.120.34
country_id: 2921044
description:
Jun 25 20:44:25 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.62.120.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.40
country_id: 2661886
description:
171.25.193.40 - zsfyjiji [25/Jun/2026:20:44:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6319977&pdata=https%253A%252F%252Fatms.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420290 HTTP/2.0" 302 0 atms.tg "https://atms.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.137.14.105
country_id: 2750405
description:
204.137.14.105 - cietg [25/Jun/2026:20:45:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13288596&pdata=https%253A%252F%252Fc2ie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420347 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.137.14.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.123.210.22
country_id: 1819730
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:190.123.210.22||TA:190.123.210.22||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.137.14.105
country_id: 2750405
description:
[2026-06-25 20:45:49 +0000] info [cpaneld] 204.137.14.105 - cietg "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.66
country_id: 6252001
description:
[2026-06-25 20:45:57 +0000] info [cpaneld] 124.198.131.66 - rolle "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.250
country_id: 3865483
description:
Jun 25 20:46:00 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.250 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.137.14.105
country_id: 2750405
description:
204.137.14.105 - cietg [25/Jun/2026:20:46:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933978&pdata=https%253A%252F%252Fc2ie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420387 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.137.14.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.95.17.234
country_id: 6252001
description:
[2026-06-25 20:47:08 +0000] info [cpaneld] 72.95.17.234 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.69.48.40
country_id: 6252001
description:
[2026-06-25 20:47:12 +0000] info [cpaneld] 73.69.48.40 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.137.14.105
country_id: 2750405
description:
[2026-06-25 20:46:28 +0000] info [cpaneld] 204.137.14.105 - cietg "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.176.96.71
country_id: 6252001
description:
[2026-06-25 20:47:02 +0000] info [cpaneld] 24.176.96.71 - lepointactu "GET /login/?login_only=1&user=lepointactu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointactu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.49.117
country_id: 6252001
description:
2026-06-25 20:47:26 dovecot_plain authenticator failed for H=(2o1k8ll8bk58jwjiovfg5mx) [198.71.49.117]:59678: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.135
country_id: 2635167
description:
[2026-06-25 20:47:32 +0000] info [cpaneld] 195.63.26.135 - vuvwskxh "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.137.14.105
country_id: 2750405
description:
204.137.14.105 - nmvhuvgp [25/Jun/2026:20:47:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607580&pdata=https%253A%252F%252Flerendez-vous.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420468 HTTP/2.0" 302 0 lerendez-vous.tg "https://lerendez-vous.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.137.14.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 20:47:58 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 157.15.40.58
country_id: 1643084
domain: case-afrique.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:177241||Sizes:1077||Combined size:1077||User:prbthzuj||WPU:||Filename:icoydclne.zip||Scanned:/tmp//20260625-204820-aj2UFFBiBhNUCnbDqYJmDQAAAA8-file-xO6GXN||SC:/home/prbthzuj/public_html/index.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.85.109.153
country_id: 6252001
description:
[2026-06-25 20:47:22 +0000] info [cpaneld] 146.85.109.153 - lepoi "GET /login/?login_only=1&user=lepoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepoi (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.76.153.253
country_id: 2750405
description:
192.76.153.253 - utkxprkk [25/Jun/2026:20:48:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7102821&pdata=https%253A%252F%252Fletempsdaider.org%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420525 HTTP/2.0" 302 0 letempsdaider.org "https://letempsdaider.org:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.76.153.253


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.8.70
country_id: 2960313
description:
107.189.8.70 - hnefmnqz [25/Jun/2026:20:48:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986665&pdata=https%253A%252F%252Fcommunewawa2.mairie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420532 HTTP/2.0" 302 0 communewawa2.mairie.tg "https://communewawa2.mairie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.8.70


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.8.70
country_id: 2960313
description:
107.189.8.70 - ruuwezvf [25/Jun/2026:20:49:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13288906&pdata=https%253A%252F%252Fmafisteel.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420569 HTTP/2.0" 302 0 mafisteel.tg "https://mafisteel.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.8.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 25 20:50:03 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.145.7.120
country_id: 6252001
description:
[2026-06-25 20:50:15 +0000] info [cpaneld] 67.145.7.120 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.241.53.3
country_id: 6252001
description:
[2026-06-25 20:50:18 +0000] info [cpaneld] 72.241.53.3 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.110.101.214
country_id: 6252001
description:
[2026-06-25 20:51:10 +0000] info [cpaneld] 68.110.101.214 - univers "GET /login/?login_only=1&user=univers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.148.36
country_id: 6252001
description:
[2026-06-25 20:50:24 +0000] info [cpaneld] 172.56.148.36 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.226.103.194
country_id: 6252001
description:
[2026-06-25 20:50:54 +0000] info [cpaneld] 75.226.103.194 - universcom "GET /login/?login_only=1&user=universcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.133.0.235
country_id: 798544
description:
31.133.0.235 - uljcqiuy [25/Jun/2026:20:51:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200075&pdata=https%253A%252F%252Fdaula.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420678 HTTP/2.0" 302 0 daula.tg "https://daula.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.133.0.235


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.157.113.51
country_id: 6252001
description:
[2026-06-25 20:50:27 +0000] info [cpaneld] 76.157.113.51 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.58.41.156
country_id: 2921044
description:
89.58.41.156 - ebbmnmtd [25/Jun/2026:20:50:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050395&pdata=https%253A%252F%252Fmetaart.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420638 HTTP/2.0" 302 0 metaart.tg "https://metaart.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.58.41.156


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.50.47.196
country_id: 6252001
description:
[2026-06-25 20:51:45 +0000] info [cpaneld] 136.50.47.196 - bieredj "GET /login/?login_only=1&user=bieredj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.195.75.216
country_id: 6252001
description:
[2026-06-25 20:51:48 +0000] info [cpaneld] 206.195.75.216 - biered "GET /login/?login_only=1&user=biered&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user biered (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.133.0.235
country_id: 798544
description:
31.133.0.235 - zauwogvk [25/Jun/2026:20:51:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131098&pdata=https%253A%252F%252Fscafricaplc.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420712 HTTP/2.0" 302 0 scafricaplc.com "https://scafricaplc.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.133.0.235


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.17.254
country_id: 6251999
description:
[2026-06-25 20:52:02 +0000] info [cpaneld] 195.63.17.254 - qfaclpeg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.143.85.147
country_id: 6252001
description:
[2026-06-25 20:52:18 +0000] info [cpaneld] 73.143.85.147 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.85.146
country_id: 6252001
description:
[2026-06-25 20:51:25 +0000] info [cpaneld] 143.105.85.146 - univ "GET /login/?login_only=1&user=univ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.235.7.69
country_id: 6252001
description:
[2026-06-25 20:51:28 +0000] info [cpaneld] 71.235.7.69 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.46.30.33
country_id: 6252001
description:
[2026-06-25 20:51:41 +0000] info [cpaneld] 73.46.30.33 - bieredja "GET /login/?login_only=1&user=bieredja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredja (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.85.109.153
country_id: 6252001
description:
[2026-06-25 20:51:55 +0000] info [cpaneld] 146.85.109.153 - bier "GET /login/?login_only=1&user=bier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.53.243
country_id: 3932488
description:
[2026-06-25 20:52:47 +0000] info [cpaneld] 38.25.53.243 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.158.151
country_id: 1733045
description:
[2026-06-25 20:52:50 +0000] info [cpaneld] 161.142.158.151 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.149
country_id: 1880251
description:
43.173.181.149 - - [25/Jun/2026:20:53:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104456&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F57429&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420788 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/57429" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.149


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.197.3.231
country_id: 6252001
description:
[2026-06-25 20:52:22 +0000] info [cpaneld] 162.197.3.231 - opaconseils "GET /login/?login_only=1&user=opaconseils&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconseils (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.133.0.235
country_id: 798544
description:
31.133.0.235 - efberwhk [25/Jun/2026:20:52:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908315&pdata=https%253A%252F%252Fsncom.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420744 HTTP/2.0" 302 0 sncom.tg "https://sncom.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.133.0.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.233
country_id: 3469034
description:
Jun 25 20:52:45 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.233 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.198.48.125
country_id: 6252001
description:
[2026-06-25 20:52:48 +0000] info [cpaneld] 68.198.48.125 - opa "GET /login/?login_only=1&user=opa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.17.5.158
country_id: 3865483
description:
[2026-06-25 20:52:53 +0000] info [cpaneld] 38.17.5.158 - lvd "GET /login/?login_only=1&user=lvd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.154.89.197
country_id: 2264397
description:
[2026-06-25 20:52:56 +0000] info [cpaneld] 82.154.89.197 - lv "GET /login/?login_only=1&user=lv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lv (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.164.151.251
country_id: 1269750
description:
Jun 25 20:52:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.164.151.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.133.0.235
country_id: 798544
description:
[2026-06-25 20:52:42 +0000] info [cpaneld] 31.133.0.235 - pkyvzjjc "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.133.0.235
country_id: 798544
description:
31.133.0.235 - lecdsntn [25/Jun/2026:20:53:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235692&pdata=https%253A%252F%252Fopa-conseils.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420815 HTTP/2.0" 302 0 opa-conseils.tg "https://opa-conseils.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.133.0.235


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.78.24
country_id: 6252001
description:
[2026-06-25 20:53:49 +0000] info [cpaneld] 217.181.78.24 - mipbtgnb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.227
country_id: 6251999
description:
[2026-06-25 20:53:30 +0000] info [cpaneld] 217.181.82.227 - vejjghdd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.217.197
country_id: 6252001
description:
[2026-06-25 20:53:51 +0000] info [cpaneld] 104.34.217.197 - letabloi "GET /login/?login_only=1&user=letabloi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.63.119.221
country_id: 6252001
description:
[2026-06-25 20:54:01 +0000] info [cpaneld] 173.63.119.221 - letab "GET /login/?login_only=1&user=letab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.169.60.68
country_id: 6252001
description:
[2026-06-25 20:55:07 +0000] info [cpaneld] 104.169.60.68 - benat "GET /login/?login_only=1&user=benat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.215.41
country_id: 6252001
description:
[2026-06-25 20:56:05 +0000] info [cpaneld] 172.59.215.41 - lagora "GET /login/?login_only=1&user=lagora&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagora (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.105
country_id: 2921044
description:
185.220.101.105 - gsizyncj [25/Jun/2026:20:55:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004698&pdata=https%253A%252F%252Fortouche.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420921 HTTP/2.0" 302 0 ortouche.com "https://ortouche.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.117.133.122
country_id: 6252001
description:
[2026-06-25 20:55:29 +0000] info [cpaneld] 70.117.133.122 - centi "GET /login/?login_only=1&user=centi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user centi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.71.244.97
country_id: 6252001
description:
[2026-06-25 20:55:53 +0000] info [cpaneld] 74.71.244.97 - lagorainfotg "GET /login/?login_only=1&user=lagorainfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainfotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.10.139.0
country_id: 6252001
description:
[2026-06-25 20:56:01 +0000] info [cpaneld] 67.10.139.0 - lagorai "GET /login/?login_only=1&user=lagorai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.49.10.120
country_id: 6252001
description:
[2026-06-25 20:56:16 +0000] info [cpaneld] 173.49.10.120 - lag "GET /login/?login_only=1&user=lag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.192.20.179
country_id: 6252001
description:
[2026-06-25 20:55:26 +0000] info [cpaneld] 72.192.20.179 - centiftg "GET /login/?login_only=1&user=centiftg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user centiftg (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.134.94.78
country_id: 1831722
description:
[2026-06-25 20:55:27 +0000] info [cpaneld] 103.134.94.78 NEW rbnbkmre:myg01Pvhl5MRL73a address=103.134.94.78,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 120.53.103.14
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/awatse-zan-2026-dans-le-bas-mono-un-festival-de-traditions-et-dinnovations/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.71.234
country_id: 6252001
description:
[2026-06-25 20:56:46 +0000] info [cpaneld] 217.181.71.234 - sahamtg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.105
country_id: 2921044
description:
185.220.101.105 - mgvybwur [25/Jun/2026:20:56:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051617&pdata=https%253A%252F%252Ffundacionesperanzatogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421012 HTTP/2.0" 302 0 fundacionesperanzatogo.tg "https://fundacionesperanzatogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.60.76.163
country_id: 6252001
description:
[2026-06-25 20:57:12 +0000] info [cpaneld] 139.60.76.163 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.181.83
country_id: 3895114
description:
[2026-06-25 20:57:46 +0000] info [cpaneld] 181.42.181.83 - zep "GET /login/?login_only=1&user=zep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.155.31
country_id: 1562822
description:
[2026-06-25 20:58:15 +0000] info [cpaneld] 171.225.155.31 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 85.208.115.126
country_id: 146669
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:85.208.115.126||TA:85.208.115.126||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 20:58:12 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.79.144.56
country_id: 3017382
description:
[2026-06-25 20:57:30 +0000] info [cpaneld] 90.79.144.56 - zephyrtg "GET /login/?login_only=1&user=zephyrtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyrtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.245.5
country_id: 3865483
description:
[2026-06-25 20:57:40 +0000] info [cpaneld] 186.22.245.5 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.77.174
country_id: 6252001
description:
[2026-06-25 20:58:13 +0000] info [cpaneld] 217.181.77.174 - doufelg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.122.2.248
country_id: 3865483
description:
[2026-06-25 20:58:20 +0000] info [cpaneld] 186.122.2.248 - cecap "GET /login/?login_only=1&user=cecap&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecap (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.48.170
country_id: 3508796
description:
[2026-06-25 20:57:33 +0000] info [cpaneld] 38.51.48.170 - zephy "GET /login/?login_only=1&user=zephy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.34.56.209
country_id: 2921044
description:
[2026-06-25 20:58:35 +0000] info [cpaneld] 78.34.56.209 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.166.112.206
country_id: 3469034
description:
[2026-06-25 20:58:25 +0000] info [cpaneld] 45.166.112.206 - cecaptg "GET /login/?login_only=1&user=cecaptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecaptg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.201.127.85
country_id: 2802361
description:
[2026-06-25 20:58:28 +0000] info [cpaneld] 85.201.127.85 - ceca "GET /login/?login_only=1&user=ceca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.107.166.82
country_id: 2589581
description:
[2026-06-25 20:58:33 +0000] info [cpaneld] 105.107.166.82 - cec "GET /login/?login_only=1&user=cec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cec (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 168.144.115.253
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 168.144.115.253: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.17.248
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:167.253.17.248||TA:167.253.17.248||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 25 20:59:50 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.163.157.49
country_id: 3017382
description:
194.163.157.49 - wgqhqbem [25/Jun/2026:21:00:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516117&pdata=https%253A%252F%252Ftogocarrierebetons.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421219 HTTP/2.0" 302 0 togocarrierebetons.tg "https://togocarrierebetons.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.163.157.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.100.247
country_id: 2921044
description:
185.220.100.247 - naduwpdk [25/Jun/2026:21:00:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674136&pdata=https%253A%252F%252Ftilitulab.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421206 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.100.247


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.216.28
country_id: 2363686
description:
[2026-06-25 21:00:13 +0000] info [cpaneld] 102.64.216.28 - emupgdkn "GET /cpsess2102475054/frontend/jupiter/sql/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.152.56] != Current IP Address [102.64.216.28]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.45
country_id: 2661886
description:
171.25.193.45 - hphhdcxi [25/Jun/2026:20:59:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923532&pdata=https%253A%252F%252Ftest.free.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421174 HTTP/2.0" 302 0 test.free.netmaster.tg "https://test.free.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.45


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.222.85
country_id: 3686110
description:
[2026-06-25 21:00:48 +0000] info [cpaneld] 45.172.222.85 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.163.157.49
country_id: 3017382
description:
194.163.157.49 - ifxmoxbf [25/Jun/2026:21:00:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932420&pdata=https%253A%252F%252Ftogofarm.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421235 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.163.157.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.36.188.21
country_id: 3469034
description:
[2026-06-25 21:00:45 +0000] info [cpaneld] 191.36.188.21 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.183.157.214
country_id: 2921044
description:
[2026-06-25 21:01:09 +0000] info [cpaneld] 185.183.157.214 - qledpnjw "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.122.182.77
country_id: 3865483
description:
[2026-06-25 21:00:55 +0000] info [cpaneld] 190.122.182.77 - aria "GET /login/?login_only=1&user=aria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aria (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.114.186.73
country_id: 6252001
description:
[2026-06-25 21:01:20 +0000] info [cpaneld] 69.114.186.73 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 157.15.40.58
country_id: 1643084
domain: letempsdaider.org
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:203390||Sizes:1079||Combined size:1079||User:utkxprkk||WPU:||Filename:icojaxaba.zip||Scanned:/tmp//20260625-210043-aj2W-0I8jpYyQ0NKpTbtzAAAACk-file-rF2AyV||SC:/home/utkxprkk/public_html/index.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.64.238
country_id: 6252001
description:
[2026-06-25 21:01:06 +0000] info [cpaneld] 172.59.64.238 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.216.28
country_id: 2363686
description:
[2026-06-25 21:00:32 +0000] info [cpaneld] 102.64.216.28 - admin_mig "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_mig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.11.189.212
country_id: 2510769
description:
[2026-06-25 21:01:01 +0000] info [cpaneld] 88.11.189.212 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.207.64.181
country_id: 3996063
description:
[2026-06-25 21:00:58 +0000] info [cpaneld] 187.207.64.181 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.172.168.187
country_id: 6252001
description:
[2026-06-25 21:01:13 +0000] info [cpaneld] 207.172.168.187 - tilitulabtg "GET /login/?login_only=1&user=tilitulabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.140.67.93
country_id: 3469034
description:
[2026-06-25 21:00:41 +0000] info [cpaneld] 192.140.67.93 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.163.157.49
country_id: 3017382
description:
[2026-06-25 21:00:49 +0000] info [cpaneld] 194.163.157.49 - qledpnjw "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.183.157.214
country_id: 2921044
description:
185.183.157.214 - qledpnjw [25/Jun/2026:21:01:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208363&pdata=https%253A%252F%252Ftogofeed.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421268 HTTP/2.0" 302 0 togofeed.tg "https://togofeed.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.183.157.214


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.229.10.233
country_id: 6252001
description:
[2026-06-25 21:02:07 +0000] info [cpaneld] 71.229.10.233 - letabloi "GET /login/?login_only=1&user=letabloi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloi (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.183.157.214
country_id: 2921044
description:
185.183.157.214 - qledpnjw [25/Jun/2026:21:01:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197351&pdata=https%253A%252F%252Ftogofeed.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421287 HTTP/2.0" 302 0 togofeed.tg "https://togofeed.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.183.157.214


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.216.28
country_id: 2363686
description:
[2026-06-25 21:01:31 +0000] info [cpaneld] 102.64.216.28 - admin_mig "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_mig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.80.54.114
country_id: 6252001
description:
[2026-06-25 21:02:00 +0000] info [cpaneld] 74.80.54.114 - letabloid "GET /login/?login_only=1&user=letabloid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.177.199.230
country_id: 6252001
description:
[2026-06-25 21:01:26 +0000] info [cpaneld] 209.177.199.230 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.94.205.93
country_id: 6252001
description:
[2026-06-25 21:02:04 +0000] info [cpaneld] 71.94.205.93 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.218.6
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/investissement-agricole-une-cellule-pour-garantir-un-climat-foncier-securise/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.183.157.214
country_id: 2921044
description:
[2026-06-25 21:01:29 +0000] info [cpaneld] 185.183.157.214 - qledpnjw "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.179.239.148
country_id: 6252001
description:
[2026-06-25 21:01:34 +0000] info [cpaneld] 73.179.239.148 - til "GET /login/?login_only=1&user=til&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user til (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.59.92.130
country_id: 6252001
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.190.66.210
country_id: 6252001
description:
[2026-06-25 21:01:38 +0000] info [cpaneld] 65.190.66.210 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 159.203.113.31
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; TechDetect/1.0) HeadlessChrome/145.0.7632.46 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.83.255.81
country_id: 6252001
description:
[2026-06-25 21:03:39 +0000] info [cpaneld] 68.83.255.81 - alloaciotg "GET /login/?login_only=1&user=alloaciotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloaciotg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.183.157.214
country_id: 2921044
description:
185.183.157.214 - kqracgxh [25/Jun/2026:21:03:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208919&pdata=https%253A%252F%252Funiverscom.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421421 HTTP/2.0" 302 0 universcom.tg "https://universcom.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.183.157.214


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.133.137.135
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.133.137.135: 80 connections per 30 seconds to 2096 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-25 21:03:50 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:38046: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.216.28
country_id: 2363686
description:
[2026-06-25 21:04:22 +0000] info [cpaneld] 102.64.216.28 - admin_mig "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_mig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.222.94.126
country_id: 6252001
description:
[2026-06-25 21:03:28 +0000] info [cpaneld] 104.222.94.126 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.134.133.194
country_id: 6252001
description:
[2026-06-25 21:03:49 +0000] info [cpaneld] 9.134.133.194 - alloa "GET /login/?login_only=1&user=alloa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.173.194.3
country_id: 6252001
description:
[2026-06-25 21:04:47 +0000] info [cpaneld] 209.173.194.3 - certlogisticstogocom "GET /login/?login_only=1&user=certlogisticstogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.81.208.21
country_id: 6252001
description:
[2026-06-25 21:04:45 +0000] info [cpaneld] 68.81.208.21 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.124.170
country_id: 6252001
description:
[2026-06-25 21:04:54 +0000] info [cpaneld] 153.67.124.170 - certlog "GET /login/?login_only=1&user=certlog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.106.165
country_id: 6252001
description:
[2026-06-25 21:05:06 +0000] info [cpaneld] 68.99.106.165 - cert "GET /login/?login_only=1&user=cert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cert (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.244.79.61
country_id: 2658434
description:
104.244.79.61 - wwayrzpl [25/Jun/2026:21:04:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987487&pdata=https%253A%252F%252Fzontalomemillenium.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421486 HTTP/2.0" 302 0 zontalomemillenium.tg "https://zontalomemillenium.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.244.79.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.192.68.198
country_id: 6252001
description:
[2026-06-25 21:04:50 +0000] info [cpaneld] 98.192.68.198 - certlogi "GET /login/?login_only=1&user=certlogi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.140.50.189
country_id: 3686110
description:
[2026-06-25 21:05:15 +0000] info [cpaneld] 181.140.50.189 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.7.144
country_id: 2960313
description:
107.189.7.144 - wwayrzpl [25/Jun/2026:21:05:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001256&pdata=https%253A%252F%252Fzontalomemillenium.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421517 HTTP/2.0" 302 0 zontalomemillenium.tg "https://zontalomemillenium.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.7.144


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.146.50.43
country_id: 6252001
description:
[2026-06-25 21:04:54 +0000] info [cpaneld] 73.146.50.43 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.66.244.242
country_id: 6252001
description:
[2026-06-25 21:05:03 +0000] info [cpaneld] 64.66.244.242 - certl "GET /login/?login_only=1&user=certl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.75.111.55
country_id: 3469034
description:
[2026-06-25 21:05:40 +0000] info [cpaneld] 177.75.111.55 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.86.96.241
country_id: 102358
description:
[2026-06-25 21:05:49 +0000] info [cpaneld] 178.86.96.241 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.161.69.46
country_id: 1210997
description:
[2026-06-25 21:06:05 +0000] info [cpaneld] 103.161.69.46 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.226.111.71
country_id: 2802361
description:
[2026-06-25 21:05:43 +0000] info [cpaneld] 94.226.111.71 - sococimtg "GET /login/?login_only=1&user=sococimtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococimtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.68.125.75
country_id: 1643084
description:
[2026-06-25 21:05:56 +0000] info [cpaneld] 36.68.125.75 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.170.201.86
country_id: 3277605
description:
[2026-06-25 21:05:28 +0000] info [cpaneld] 141.170.201.86 - las "GET /login/?login_only=1&user=las&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user las (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.37.195.222
country_id: 3865483
description:
[2026-06-25 21:05:33 +0000] info [cpaneld] 179.37.195.222 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.7.144
country_id: 2960313
description:
107.189.7.144 - wwayrzpl [25/Jun/2026:21:05:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181926&pdata=https%253A%252F%252Fzontalomemillenium.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782421526 HTTP/2.0" 302 0 zontalomemillenium.tg "https://zontalomemillenium.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.7.144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.62.76.187
country_id: 1269750
description:
Jun 25 21:07:18 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.62.76.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-25 21:06:22 +0000] info [cpaneld] 5.230.133.20 NEW wcnyaruu:HmBlasTQd_xS4pol address=5.230.133.20,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.12.70.22
country_id: 690791
description:
Jun 25 21:08:54 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.12.70.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.185.74
country_id: 2017370
description:
[2026-06-25 21:09:43 +0000] info [cpaneld] 109.252.185.74 - saham "GET /login/?login_only=1&user=saham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saham (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.156.232.249
country_id: 3996063
description:
[2026-06-25 21:09:52 +0000] info [cpaneld] 189.156.232.249 - sah "GET /login/?login_only=1&user=sah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.138.216.113
country_id: 6252001
description:
[2026-06-25 21:09:26 +0000] info [cpaneld] 9.138.216.113 - tp "GET /login/?login_only=1&user=tp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.248.77.53
country_id: 294640
description:
[2026-06-25 21:09:55 +0000] info [cpaneld] 178.248.77.53 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.134.205.33
country_id: 3865483
description:
[2026-06-25 21:09:30 +0000] info [cpaneld] 186.134.205.33 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.167.35
country_id: 3923057
description:
[2026-06-25 21:09:35 +0000] info [cpaneld] 181.115.167.35 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.239.49.158
country_id: 3658394
description:
[2026-06-25 21:09:47 +0000] info [cpaneld] 45.239.49.158 - saha "GET /login/?login_only=1&user=saha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.188.129.212
country_id: 2017370
description:
[2026-06-25 21:09:25 +0000] info [cpaneld] 95.188.129.212 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.115.120.219
country_id: 6252001
description:
[2026-06-25 21:11:46 +0000] info [cpaneld] 98.115.120.219 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.66
country_id: 6252001
description:
[2026-06-25 21:12:54 +0000] info [cpaneld] 124.198.131.66 - rolle "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-25 21:13:01 +0000] info [cpaneld] 104.28.160.166 - e.sanvee "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.180.102
country_id: 6252001
description:
[2026-06-25 21:14:07 +0000] info [cpaneld] 73.196.180.102 - fbafrica "GET /login/?login_only=1&user=fbafrica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafrica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.211.21.14
country_id: 6252001
description:
[2026-06-25 21:14:15 +0000] info [cpaneld] 66.211.21.14 - fbafric "GET /login/?login_only=1&user=fbafric&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafric (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.85.227
country_id: 1062947
description:
[2026-06-25 21:15:20 +0000] info [cpaneld] 153.67.85.227 - ekeasarlcom "GET /login/?login_only=1&user=ekeasarlcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarlcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.69.247
country_id: 3865483
description:
[2026-06-25 21:15:11 +0000] info [cpaneld] 148.227.69.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.161.178.71
country_id: 290291
description:
[2026-06-25 21:15:16 +0000] info [cpaneld] 109.161.178.71 - ekeasarl "GET /login/?login_only=1&user=ekeasarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.193.148.95
country_id: 6252001
description:
[2026-06-25 21:14:26 +0000] info [cpaneld] 74.193.148.95 - fbafr "GET /login/?login_only=1&user=fbafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.45.52.13
country_id: 3895114
description:
[2026-06-25 21:15:25 +0000] info [cpaneld] 190.45.52.13 - ekeasar "GET /login/?login_only=1&user=ekeasar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.63.2
country_id: 3865483
description:
[2026-06-25 21:15:31 +0000] info [cpaneld] 138.84.63.2 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.9.70.193
country_id: 3865483
description:
[2026-06-25 21:15:44 +0000] info [cpaneld] 190.9.70.193 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.222.204.102
country_id: 1814991
description:
54.222.204.102 - - [25/Jun/2026:21:15:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936293&pdata=https%253A%252F%252Fdirect7.tg%252Fsafer-une-importante-mission-de-suivi-sur-quatre-postes-de-peage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782422157 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/safer-une-importante-mission-de-suivi-sur-quatre-postes-de-peage/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.9346.1100 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.222.204.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.140.19.110
country_id: 2921044
description:
[2026-06-25 21:15:36 +0000] info [cpaneld] 84.140.19.110 - ekeas "GET /login/?login_only=1&user=ekeas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeas (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.133.62.17
country_id: 1643084
description:
103.133.62.17 - - [25/Jun/2026:21:17:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939723&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-vers-la-creation-de-la-premiere-aire-marine-protegee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782422264 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-vers-la-creation-de-la-premiere-aire-marine-protegee/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.8911.1761 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.133.62.17


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.150.36.172
country_id: 6252001
description:
[2026-06-25 21:19:19 +0000] info [cpaneld] 209.150.36.172 - zep "GET /login/?login_only=1&user=zep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.39.47.125
country_id: 6252001
description:
[2026-06-25 21:19:22 +0000] info [cpaneld] 108.39.47.125 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.96.13
country_id: 6252001
description:
[2026-06-25 21:18:59 +0000] info [cpaneld] 96.245.96.13 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 21:19:11 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.198.56.174
country_id: 6252001
description:
[2026-06-25 21:19:55 +0000] info [cpaneld] 47.198.56.174 - ed "GET /login/?login_only=1&user=ed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.98.31
country_id: 6252001
description:
[2026-06-25 21:19:38 +0000] info [cpaneld] 47.147.98.31 - educpl "GET /login/?login_only=1&user=educpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educpl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.207.186.230
country_id: 6252001
description:
[2026-06-25 21:21:05 +0000] info [cpaneld] 71.207.186.230 - socialin "GET /login/?login_only=1&user=socialin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.157.212.132
country_id: 6252001
description:
[2026-06-25 21:20:58 +0000] info [cpaneld] 76.157.212.132 - socialinfos "GET /login/?login_only=1&user=socialinfos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialinfos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.17.177.15
country_id: 6252001
description:
[2026-06-25 21:20:36 +0000] info [cpaneld] 65.17.177.15 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.234.93.103
country_id: 6252001
description:
[2026-06-25 21:20:57 +0000] info [cpaneld] 97.234.93.103 - lcr "GET /login/?login_only=1&user=lcr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.172.235.26
country_id: 6252001
description:
[2026-06-25 21:21:01 +0000] info [cpaneld] 173.172.235.26 - lc "GET /login/?login_only=1&user=lc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.227.94.98
country_id: 6252001
description:
[2026-06-25 21:21:22 +0000] info [cpaneld] 73.227.94.98 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.182.120.231
country_id: 6252001
description:
[2026-06-25 21:20:39 +0000] info [cpaneld] 66.182.120.231 - lcradem "GET /login/?login_only=1&user=lcradem&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcradem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.118.149.4
country_id: 6252001
description:
[2026-06-25 21:20:53 +0000] info [cpaneld] 76.118.149.4 - lcra "GET /login/?login_only=1&user=lcra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.108.21
country_id: 99237
description:
[2026-06-25 21:22:19 +0000] info [cpaneld] 185.181.108.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 157.15.40.58
country_id: 1643084
domain: fbafrica.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:294146||Sizes:1079||Combined size:1079||User:arsjawjaz||WPU:||Filename:icokxqdrq.zip||Scanned:/tmp//20260625-212148-aj2b7EbKnxSVpooAVhu1rAAAACw-file-tYEWfa||SC:/home/arsjawjaz/public_html/index.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.236.235.20
country_id: 298795
description:
[2026-06-25 21:22:21 +0000] info [cpaneld] 176.236.235.20 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.171.117
country_id: 3865483
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=602 HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.171.117
country_id: 3865483
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=602 HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.136.42.58
country_id: 2635167
description:
Jun 25 21:22:45 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.136.42.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.128.162.253
country_id: 285570
description:
[2026-06-25 21:22:33 +0000] info [cpaneld] 94.128.162.253 - aria "GET /login/?login_only=1&user=aria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aria (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.143.107.213
country_id: 6252001
description:
[2026-06-25 21:22:56 +0000] info [cpaneld] 76.143.107.213 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.10.134.147
country_id: 6252001
description:
[2026-06-25 21:23:21 +0000] info [cpaneld] 73.10.134.147 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.20
country_id: 99237
description:
[2026-06-25 21:23:22 +0000] info [cpaneld] 212.237.121.20 - togoathl "GET /login/?login_only=1&user=togoathl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.200.240.228
country_id: 2921044
description:
[2026-06-25 21:23:15 +0000] info [cpaneld] 178.200.240.228 - togoathletisme "GET /login/?login_only=1&user=togoathletisme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletisme (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 21:23:17 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.157.75.1
country_id: 3996063
description:
[2026-06-25 21:23:27 +0000] info [cpaneld] 189.157.75.1 - togoath "GET /login/?login_only=1&user=togoath&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoath (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.71.205.154
country_id: 285570
description:
[2026-06-25 21:23:34 +0000] info [cpaneld] 188.71.205.154 - togoat "GET /login/?login_only=1&user=togoat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.155.128.93
country_id: 3996063
description:
[2026-06-25 21:24:02 +0000] info [cpaneld] 189.155.128.93 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.11.109
country_id: 3469034
description:
[2026-06-25 21:24:05 +0000] info [cpaneld] 177.124.11.109 - leadellestg "GET /login/?login_only=1&user=leadellestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadellestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.118.140.36
country_id: 2921044
description:
[2026-06-25 21:23:40 +0000] info [cpaneld] 84.118.140.36 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.81.165.243
country_id: 6252001
description:
[2026-06-25 21:23:39 +0000] info [cpaneld] 162.81.165.243 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.227.103.213
country_id: 6252001
description:
[2026-06-25 21:23:42 +0000] info [cpaneld] 12.227.103.213 - ekeas "GET /login/?login_only=1&user=ekeas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.192.159.145
country_id: 6252001
description:
[2026-06-25 21:23:47 +0000] info [cpaneld] 98.192.159.145 - ekea "GET /login/?login_only=1&user=ekea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.58.74.175
country_id: 1210997
description:
[2026-06-25 21:24:21 +0000] info [cpaneld] 103.58.74.175 - lea "GET /login/?login_only=1&user=lea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lea (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.35.8.45
country_id: 6252001
description:
Jun 25 21:23:25 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.35.8.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.105.204.208
country_id: 6252001
description:
[2026-06-25 21:23:26 +0000] info [cpaneld] 73.105.204.208 - ekeasarl "GET /login/?login_only=1&user=ekeasarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.42.245.112
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:193.42.245.112||TA:193.42.245.112||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.253.3.3
country_id: 6252001
description:
[2026-06-25 21:23:36 +0000] info [cpaneld] 64.253.3.3 - ekeasar "GET /login/?login_only=1&user=ekeasar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.248.164.52
country_id: 3625428
description:
[2026-06-25 21:23:37 +0000] info [cpaneld] 38.248.164.52 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.62.150.241
country_id: 597427
description:
[2026-06-25 21:23:47 +0000] info [cpaneld] 78.62.150.241 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.233.182.171
country_id: 2921044
description:
[2026-06-25 21:24:00 +0000] info [cpaneld] 79.233.182.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.24.66.40
country_id: 6252001
description:
[2026-06-25 21:23:31 +0000] info [cpaneld] 76.24.66.40 - ekeasarlcom "GET /login/?login_only=1&user=ekeasarlcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarlcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.190.199.247
country_id: 3017382
description:
[2026-06-25 21:24:16 +0000] info [cpaneld] 88.190.199.247 - leade "GET /login/?login_only=1&user=leade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.72.242.71
country_id: 2750405
description:
[2026-06-25 21:24:18 +0000] info [cpaneld] 82.72.242.71 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.218.117.53
country_id: 2017370
description:
[2026-06-25 21:24:24 +0000] info [cpaneld] 178.218.117.53 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.164.126.180
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 104.164.126.180: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.207.237
country_id: 3439705
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.207.237
country_id: 3439705
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.60.103.16
country_id: 1269750
description:
Jun 25 21:26:46 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.60.103.16 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.32.254.112
country_id: 99237
description:
213.32.254.112 - - [25/Jun/2026:21:26:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934235&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-374248sitems%252Fetidm53en.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782422815 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-374248sitems/etidm53en.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.32.254.112


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.14.246.44
country_id: 1814991
description:
Jun 25 21:27:43 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.14.246.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.14.246.44
country_id: 1814991
description:
2026-06-25 21:27:45 dovecot_plain authenticator failed for H=(3ucbv08bhsnl1sxd21rb7ycu) [106.14.246.44]:37056: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.58.115.212
country_id: 6252001
description:
[2026-06-25 21:29:00 +0000] info [cpaneld] 72.58.115.212 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.62.26.40
country_id: 6252001
description:
[2026-06-25 21:28:36 +0000] info [cpaneld] 173.62.26.40 - davakconsultingcom "GET /login/?login_only=1&user=davakconsultingcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsultingcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.35.252.137
country_id: 6252001
description:
[2026-06-25 21:28:38 +0000] info [cpaneld] 108.35.252.137 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.66.135.160
country_id: 6252001
description:
[2026-06-25 21:28:45 +0000] info [cpaneld] 173.66.135.160 - davakco "GET /login/?login_only=1&user=davakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.151.251.110
country_id: 6252001
description:
[2026-06-25 21:28:45 +0000] info [cpaneld] 24.151.251.110 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.6.199.189
country_id: 6252001
description:
[2026-06-25 21:28:50 +0000] info [cpaneld] 108.6.199.189 - davakc "GET /login/?login_only=1&user=davakc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.245.66.109
country_id: 6252001
description:
[2026-06-25 21:29:22 +0000] info [cpaneld] 75.245.66.109 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.26.34.91
country_id: 6252001
description:
[2026-06-25 21:30:00 +0000] info [cpaneld] 72.26.34.91 - anamek "GET /login/?login_only=1&user=anamek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.147.188.170
country_id: 6252001
description:
[2026-06-25 21:31:09 +0000] info [cpaneld] 73.147.188.170 - ese "GET /login/?login_only=1&user=ese&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.223.110.197
country_id: 6252001
description:
[2026-06-25 21:31:44 +0000] info [cpaneld] 98.223.110.197 - davet "GET /login/?login_only=1&user=davet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.139.115.251
country_id: 6252001
description:
[2026-06-25 21:31:46 +0000] info [cpaneld] 73.139.115.251 - cog "GET /login/?login_only=1&user=cog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.135.187.204
country_id: 6252001
description:
[2026-06-25 21:31:50 +0000] info [cpaneld] 76.135.187.204 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.255.77.81
country_id: 6252001
description:
[2026-06-25 21:31:35 +0000] info [cpaneld] 71.255.77.81 - davetech "GET /login/?login_only=1&user=davetech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.220.61.168
country_id: 6252001
description:
[2026-06-25 21:31:34 +0000] info [cpaneld] 32.220.61.168 - cogeris "GET /login/?login_only=1&user=cogeris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeris (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.29.25.137
country_id: 6252001
description:
[2026-06-25 21:31:38 +0000] info [cpaneld] 108.29.25.137 - davetec "GET /login/?login_only=1&user=davetec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.102.13.161
country_id: 6252001
description:
[2026-06-25 21:31:41 +0000] info [cpaneld] 74.102.13.161 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.54.111.181
country_id: 6252001
description:
[2026-06-25 21:31:47 +0000] info [cpaneld] 108.54.111.181 - dave "GET /login/?login_only=1&user=dave&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dave (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.163.246.98
country_id: 6252001
description:
[2026-06-25 21:31:26 +0000] info [cpaneld] 73.163.246.98 - cogerisq "GET /login/?login_only=1&user=cogerisq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.72.182.24
country_id: 6252001
description:
[2026-06-25 21:31:28 +0000] info [cpaneld] 24.72.182.24 - tcham "GET /login/?login_only=1&user=tcham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcham (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.99.37.61
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-32.138.99.37.61||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.1.75.187
country_id: 6252001
description:
[2026-06-25 21:32:25 +0000] info [cpaneld] 73.1.75.187 - ortouchecom "GET /login/?login_only=1&user=ortouchecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouchecom (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.226.213
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-32.161.115.226.213||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.81.42
country_id: 6252001
description:
[2026-06-25 21:32:39 +0000] info [cpaneld] 172.59.81.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.18.230.78
country_id: 6252001
description:
[2026-06-25 21:32:41 +0000] info [cpaneld] 173.18.230.78 - orto "GET /login/?login_only=1&user=orto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user orto (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 25 21:32:40 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.255.181
country_id: 6252001
description:
[2026-06-25 21:32:43 +0000] info [cpaneld] 50.5.255.181 - droitshumains "GET /login/?login_only=1&user=droitshumains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.241.125.117
country_id: 6252001
description:
[2026-06-25 21:32:45 +0000] info [cpaneld] 151.241.125.117 - ort "GET /login/?login_only=1&user=ort&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ort (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.181.138
country_id: 3469034
description:
Jun 25 21:33:32 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.181.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.173.82.63
country_id: 298795
description:
[2026-06-25 21:35:09 +0000] info [cpaneld] 78.173.82.63 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.214.226.197
country_id: 298795
description:
[2026-06-25 21:35:17 +0000] info [cpaneld] 81.214.226.197 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.52.149.250
country_id: 6252001
description:
[2026-06-25 21:34:56 +0000] info [cpaneld] 170.52.149.250 - tps "GET /login/?login_only=1&user=tps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tps (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.223.72.116
country_id: 3469034
description:
[2026-06-25 21:35:05 +0000] info [cpaneld] 177.223.72.116 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.139.5.102
country_id: 294640
description:
[2026-06-25 21:35:21 +0000] info [cpaneld] 89.139.5.102 - fundac "GET /login/?login_only=1&user=fundac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.175.67.33
country_id: 6252001
description:
[2026-06-25 21:35:18 +0000] info [cpaneld] 75.175.67.33 - lepointactu "GET /login/?login_only=1&user=lepointactu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointactu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.245.97.53
country_id: 1522867
description:
[2026-06-25 21:35:13 +0000] info [cpaneld] 195.245.97.53 - fundacio "GET /login/?login_only=1&user=fundacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.243.171.234
country_id: 2589581
description:
[2026-06-25 21:35:35 +0000] info [cpaneld] 154.243.171.234 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.177.212.153
country_id: 6252001
description:
[2026-06-25 21:35:36 +0000] info [cpaneld] 209.177.212.153 - lepoi "GET /login/?login_only=1&user=lepoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.113.148.241
country_id: 1210997
description:
[2026-06-25 21:35:25 +0000] info [cpaneld] 103.113.148.241 - funda "GET /login/?login_only=1&user=funda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user funda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.113.11.153
country_id: 3895114
description:
[2026-06-25 21:37:23 +0000] info [cpaneld] 191.113.11.153 - davakconsulting "GET /login/?login_only=1&user=davakconsulting&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulting (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.115.231.72
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:161.115.231.72||TA:161.115.231.72||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.218.68.142
country_id: 3996063
description:
[2026-06-25 21:37:50 +0000] info [cpaneld] 189.218.68.142 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.216.219.124
country_id: 3865483
description:
[2026-06-25 21:37:33 +0000] info [cpaneld] 201.216.219.124 - davakcon "GET /login/?login_only=1&user=davakcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakcon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.98.45.16
country_id: 3686110
description:
[2026-06-25 21:37:39 +0000] info [cpaneld] 186.98.45.16 - davakc "GET /login/?login_only=1&user=davakc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 133.88.123.11
country_id: 1861060
description:
Jun 25 21:38:42 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 133.88.123.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jun 25 21:39:03 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.20.91
country_id: 6252001
description:
[2026-06-25 21:42:21 +0000] info [cpaneld] 172.89.20.91 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.53.191.150
country_id: 6252001
description:
[2026-06-25 21:41:48 +0000] info [cpaneld] 68.53.191.150 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.70.116.229
country_id: 6252001
description:
[2026-06-25 21:42:14 +0000] info [cpaneld] 174.70.116.229 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.189.161.112
country_id: 6252001
description:
[2026-06-25 21:41:43 +0000] info [cpaneld] 73.189.161.112 - beste "GET /login/?login_only=1&user=beste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user beste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.50.251.143
country_id: 6252001
description:
[2026-06-25 21:42:25 +0000] info [cpaneld] 68.50.251.143 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.39.124.210
country_id: 3469034
description:
[2026-06-25 21:43:46 +0000] info [cpaneld] 177.39.124.210 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.119.119.45
country_id: 3895114
description:
[2026-06-25 21:43:39 +0000] info [cpaneld] 191.119.119.45 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.158.58.89
country_id: 1512440
description:
[2026-06-25 21:43:50 +0000] info [cpaneld] 94.158.58.89 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.255.144.223
country_id: 3469034
description:
[2026-06-25 21:43:29 +0000] info [cpaneld] 138.255.144.223 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.172.190.57
country_id: 3996063
description:
[2026-06-25 21:43:33 +0000] info [cpaneld] 187.172.190.57 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.79.190.165
country_id: 3895114
description:
[2026-06-25 21:43:35 +0000] info [cpaneld] 186.79.190.165 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 25 21:44:25 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.254.175.103
country_id: 6252001
description:
Jun 25 21:45:34 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.254.175.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.254.175.103
country_id: 6252001
description:
2026-06-25 21:45:36 dovecot_plain authenticator failed for H=(gpv8cgoqc6u3en0yl87vl9i) [213.254.175.103]:54001: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.141.235
country_id: 6252001
description:
[2026-06-25 21:47:17 +0000] info [cpaneld] 23.243.141.235 - derou "GET /login/?login_only=1&user=derou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user derou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.255.191.243
country_id: 6252001
description:
[2026-06-25 21:47:21 +0000] info [cpaneld] 96.255.191.243 - mftogotg "GET /login/?login_only=1&user=mftogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftogotg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.228.172.98
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.228.172.98: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.38.195
country_id: 6252001
description:
[2026-06-25 21:47:22 +0000] info [cpaneld] 73.74.38.195 - deroutg "GET /login/?login_only=1&user=deroutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deroutg (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.90.180.172
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.0 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.141.216.52
country_id: 2635167
description:
86.141.216.52 - - [25/Jun/2026:21:47:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181770&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-107608iitems%252Fetidm20uk.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782424057 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-107608iitems/etidm20uk.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.141.216.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.152.246
country_id: 6252001
description:
[2026-06-25 21:49:05 +0000] info [cpaneld] 47.150.152.246 - togoathl "GET /login/?login_only=1&user=togoathl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.82.150.24
country_id: 6252001
description:
[2026-06-25 21:49:15 +0000] info [cpaneld] 75.82.150.24 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.115.226.14
country_id: 6251999
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:161.115.226.14||TA:161.115.226.14||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.225.244
country_id: 6252001
description:
[2026-06-25 21:49:02 +0000] info [cpaneld] 68.45.225.244 - togoathletismetg "GET /login/?login_only=1&user=togoathletismetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletismetg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.136
country_id: 798544
description:
Jun 25 21:49:26 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 21:50:27 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.191.80.139
country_id: 6252001
description:
[2026-06-25 21:53:12 +0000] info [cpaneld] 72.191.80.139 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.235
country_id: 1880251
description:
43.172.195.235 - - [25/Jun/2026:21:53:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13342575&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Feconomie-maintenir-le-cap-des-reformes-et-la-rigueur&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782424382 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/economie/economie-maintenir-le-cap-des-reformes-et-la-rigueur" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.235


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.106.99.243
country_id: 6252001
description:
[2026-06-25 21:53:18 +0000] info [cpaneld] 73.106.99.243 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.111.163.240
country_id: 6252001
description:
[2026-06-25 21:53:23 +0000] info [cpaneld] 75.111.163.240 - caissederetraitestg "GET /login/?login_only=1&user=caissederetraitestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraitestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.181.231.73
country_id: 6252001
description:
[2026-06-25 21:53:42 +0000] info [cpaneld] 97.181.231.73 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.35.235.248
country_id: 3469034
description:
[2026-06-25 21:54:05 +0000] info [cpaneld] 187.35.235.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.104.119
country_id: 3658394
description:
[2026-06-25 21:54:10 +0000] info [cpaneld] 157.100.104.119 - anrtogotg "GET /login/?login_only=1&user=anrtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.97.224.123
country_id: 1643084
description:
[2026-06-25 21:54:14 +0000] info [cpaneld] 103.97.224.123 - anrtog "GET /login/?login_only=1&user=anrtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.161.178
country_id: 6252001
description:
[2026-06-25 21:53:32 +0000] info [cpaneld] 38.62.161.178 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.16.203.250
country_id: 6252001
description:
[2026-06-25 21:53:30 +0000] info [cpaneld] 108.16.203.250 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.33.136.104
country_id: 3469034
description:
[2026-06-25 21:54:22 +0000] info [cpaneld] 177.33.136.104 - anrt "GET /login/?login_only=1&user=anrt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.255.114.199
country_id: 3469034
description:
[2026-06-25 21:54:27 +0000] info [cpaneld] 138.255.114.199 - anr "GET /login/?login_only=1&user=anr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.204.117
country_id: 3865483
description:
[2026-06-25 21:54:30 +0000] info [cpaneld] 186.12.204.117 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.82.234.47
country_id: 6252001
description:
[2026-06-25 21:54:40 +0000] info [cpaneld] 108.82.234.47 - las "GET /login/?login_only=1&user=las&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user las (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.37.170.66
country_id: 1814991
description:
Jun 25 21:56:13 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.37.170.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.125.70
country_id: 6252001
description:
[2026-06-25 21:55:59 +0000] info [cpaneld] 172.59.125.70 - tontonedouardtogo "GET /login/?login_only=1&user=tontonedouardtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedouardtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 21:56:18 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.191.92.24
country_id: 6252001
description:
[2026-06-25 21:56:02 +0000] info [cpaneld] 38.191.92.24 - tontonedouardtogocom "GET /login/?login_only=1&user=tontonedouardtogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedouardtogocom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.18.39
country_id: 3469034
description:
Jun 25 21:55:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.18.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 21:56:21 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 21:56:22 +0000] info [whostmgrd] 45.198.224.5 - root "GET /cpsess8266510006/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.67.215.227
country_id: 1643084
description:
Jun 25 21:56:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.67.215.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.49.31.122
country_id: 6252001
description:
[2026-06-25 21:57:15 +0000] info [cpaneld] 136.49.31.122 - sophieim "GET /login/?login_only=1&user=sophieim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieim (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.223.78.62
country_id: 934292
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/djama-pilsner HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.71.86.82
country_id: 6252001
description:
[2026-06-25 21:57:01 +0000] info [cpaneld] 198.71.86.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.156.28.129
country_id: 6252001
description:
[2026-06-25 21:57:06 +0000] info [cpaneld] 73.156.28.129 - sophieimmobilier "GET /login/?login_only=1&user=sophieimmobilier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieimmobilier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.255.217.128
country_id: 6252001
description:
[2026-06-25 21:57:13 +0000] info [cpaneld] 69.255.217.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.116.97.19
country_id: 6252001
description:
[2026-06-25 21:57:10 +0000] info [cpaneld] 98.116.97.19 - sophieimmobiliertg "GET /login/?login_only=1&user=sophieimmobiliertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieimmobiliertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.42.109
country_id: 290557
description:
[2026-06-25 21:57:28 +0000] info [cpaneld] 5.38.42.109 - togocarrieretsevietg "GET /login/?login_only=1&user=togocarrieretsevietg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevietg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.244.35.27
country_id: 6252001
description:
[2026-06-25 21:57:33 +0000] info [cpaneld] 73.244.35.27 - sop "GET /login/?login_only=1&user=sop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.129.83.151
country_id: 6252001
description:
[2026-06-25 21:57:45 +0000] info [cpaneld] 97.129.83.151 - zon "GET /login/?login_only=1&user=zon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.251.0.218
country_id: 3932488
description:
[2026-06-25 21:57:50 +0000] info [cpaneld] 132.251.0.218 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 25 21:57:22 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.99.47.236
country_id: 290557
description:
[2026-06-25 21:57:25 +0000] info [cpaneld] 86.99.47.236 - togocarrieretsevie "GET /login/?login_only=1&user=togocarrieretsevie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.62.43
country_id: 3865483
description:
[2026-06-25 21:57:32 +0000] info [cpaneld] 45.162.62.43 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.142.169.15
country_id: 3996063
description:
[2026-06-25 21:57:41 +0000] info [cpaneld] 189.142.169.15 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.10.37
country_id: 99237
description:
[2026-06-25 21:57:53 +0000] info [cpaneld] 169.224.10.37 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.62.198.131
country_id: 1733045
description:
Jun 25 21:58:08 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.62.198.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.243.46.31
country_id: 298795
description:
[2026-06-25 21:57:34 +0000] info [cpaneld] 88.243.46.31 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.177.98.23
country_id: 6252001
description:
[2026-06-25 21:57:42 +0000] info [cpaneld] 73.177.98.23 - zont "GET /login/?login_only=1&user=zont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.103.205
country_id: 290291
description:
[2026-06-25 21:57:46 +0000] info [cpaneld] 88.201.103.205 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.10.39.152
country_id: 1643084
description:
[2026-06-25 21:59:07 +0000] info [cpaneld] 114.10.39.152 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 21:58:33 +0000] info [cpaneld] 102.54.238.57 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.135
country_id: 1880251
description:
47.128.121.135 - - [25/Jun/2026:21:59:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051416&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fagents%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782424766 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/agents/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.164.151.251
country_id: 1269750
description:
Jun 25 21:59:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.164.151.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 22:00:32 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 22:00:30 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.164.151.251
country_id: 1269750
description:
Jun 25 22:01:17 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.164.151.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.175.32
country_id: 3017382
description:
Jun 25 22:02:14 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.175.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 25 22:04:18 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.210.73.165
country_id: 6252001
description:
[2026-06-25 22:04:20 +0000] info [cpaneld] 75.210.73.165 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.115.147.46
country_id: 2017370
description:
[2026-06-25 22:03:26 +0000] info [cpaneld] 176.115.147.46 - fomda "GET /login/?login_only=1&user=fomda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.2.85
country_id: 3865483
description:
[2026-06-25 22:03:23 +0000] info [cpaneld] 186.158.2.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.111.133.163
country_id: 6252001
description:
[2026-06-25 22:03:50 +0000] info [cpaneld] 98.111.133.163 - sotr "GET /login/?login_only=1&user=sotr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.207.3.200
country_id: 2287781
description:
[2026-06-25 22:03:40 +0000] info [cpaneld] 102.207.3.200 - fo "GET /login/?login_only=1&user=fo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.81.76.66
country_id: 6252001
description:
[2026-06-25 22:04:16 +0000] info [cpaneld] 50.81.76.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.37.99.91
country_id: 6252001
description:
[2026-06-25 22:04:29 +0000] info [cpaneld] 136.37.99.91 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.166.216
country_id: 6252001
description:
[2026-06-25 22:04:24 +0000] info [cpaneld] 172.56.166.216 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.87.110.87
country_id: 6252001
description:
[2026-06-25 22:04:26 +0000] info [cpaneld] 73.87.110.87 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.171.186.162
country_id: 6252001
description:
[2026-06-25 22:04:42 +0000] info [cpaneld] 70.171.186.162 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.133.248.162
country_id: 2017370
description:
[2026-06-25 22:06:56 +0000] info [cpaneld] 31.133.248.162 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.106.123.136
country_id: 783754
description:
[2026-06-25 22:07:01 +0000] info [cpaneld] 79.106.123.136 - matwtog "GET /login/?login_only=1&user=matwtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.190.194.17
country_id: 6252001
description:
[2026-06-25 22:07:16 +0000] info [cpaneld] 73.190.194.17 - sthandlingaero "GET /login/?login_only=1&user=sthandlingaero&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sthandlingaero (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.190.170.98
country_id: 1694008
description:
[2026-06-25 22:07:21 +0000] info [cpaneld] 180.190.170.98 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.131.74.74
country_id: 6252001
description:
[2026-06-25 22:07:36 +0000] info [cpaneld] 216.131.74.74 - sthan "GET /login/?login_only=1&user=sthan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sthan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.173.193.79
country_id: 6252001
description:
[2026-06-25 22:07:27 +0000] info [cpaneld] 73.173.193.79 - sthandl "GET /login/?login_only=1&user=sthandl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sthandl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.173.35
country_id: 3658394
description:
[2026-06-25 22:07:25 +0000] info [cpaneld] 148.227.173.35 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.135.171.47
country_id: 6252001
description:
[2026-06-25 22:09:50 +0000] info [cpaneld] 57.135.171.47 - vitrine "GET /login/?login_only=1&user=vitrine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.185
country_id: 3469034
description:
Jun 25 22:09:59 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.49.72.2
country_id: 6252001
description:
[2026-06-25 22:10:10 +0000] info [cpaneld] 38.49.72.2 - vit "GET /login/?login_only=1&user=vit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.180.52.172
country_id: 6252001
description:
[2026-06-25 22:10:12 +0000] info [cpaneld] 139.180.52.172 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.243.18.231
country_id: 6252001
description:
[2026-06-25 22:10:01 +0000] info [cpaneld] 172.243.18.231 - vitri "GET /login/?login_only=1&user=vitri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.93.59.93
country_id: 6252001
description:
[2026-06-25 22:10:06 +0000] info [cpaneld] 97.93.59.93 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.142.214.59
country_id: 6252001
description:
[2026-06-25 22:11:11 +0000] info [cpaneld] 40.142.214.59 - cloudandracks "GET /login/?login_only=1&user=cloudandracks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User cloudandracks has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.178.62
country_id: 6252001
description:
[2026-06-25 22:11:15 +0000] info [cpaneld] 76.170.178.62 - cloudandrackstg "GET /login/?login_only=1&user=cloudandrackstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudandrackstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.103.1.138
country_id: 6252001
description:
[2026-06-25 22:11:40 +0000] info [cpaneld] 137.103.1.138 - clo "GET /login/?login_only=1&user=clo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.152.27.147
country_id: 6252001
description:
[2026-06-25 22:11:34 +0000] info [cpaneld] 63.152.27.147 - cloud "GET /login/?login_only=1&user=cloud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloud (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.62.150.36
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/audios HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 25 22:11:58 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [25/Jun/2026:22:12:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607316&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbeach-volley-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782425544 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/beach-volley-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 22:12:54 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.105.129
country_id: 99237
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/author/admin6811/page/3/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.166.92
country_id: 6252001
description:
[2026-06-25 22:14:15 +0000] info [cpaneld] 74.105.166.92 - univ "GET /login/?login_only=1&user=univ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.239.113
country_id: 6252001
description:
[2026-06-25 22:14:22 +0000] info [cpaneld] 204.111.239.113 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.219.241.100
country_id: 6252001
description:
[2026-06-25 22:14:37 +0000] info [cpaneld] 162.219.241.100 - dir "GET /login/?login_only=1&user=dir&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dir (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.204.91.207
country_id: 2017370
description:
[2026-06-25 22:15:21 +0000] info [cpaneld] 89.204.91.207 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.249.166.12
country_id: 6252001
description:
[2026-06-25 22:14:26 +0000] info [cpaneld] 73.249.166.12 - direct "GET /login/?login_only=1&user=direct&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.160.88
country_id: 3865483
description:
[2026-06-25 22:15:56 +0000] info [cpaneld] 181.46.160.88 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.16.234
country_id: 2542007
description:
[2026-06-25 22:15:43 +0000] info [cpaneld] 196.115.16.234 - alloa "GET /login/?login_only=1&user=alloa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.202.171
country_id: 3895114
description:
[2026-06-25 22:15:32 +0000] info [cpaneld] 181.43.202.171 - alloaciotg "GET /login/?login_only=1&user=alloaciotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloaciotg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 186.132.230.130
country_id: 3865483
domain: soroubat.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:71985.soroubat.tg||ServerName:soroubat.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7c9fb74582cd27950f60344a3f7a7e7e266d18f||Title:0x5684a78b||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.209.124.205
country_id: 2017370
description:
[2026-06-25 22:15:48 +0000] info [cpaneld] 91.209.124.205 - allo "GET /login/?login_only=1&user=allo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user allo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.163.209.115
country_id: 6252001
description:
[2026-06-25 22:16:48 +0000] info [cpaneld] 97.163.209.115 - ortouc "GET /login/?login_only=1&user=ortouc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.197.62.81
country_id: 6252001
description:
[2026-06-25 22:17:05 +0000] info [cpaneld] 151.197.62.81 - or "GET /login/?login_only=1&user=or&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user or (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jun 25 22:17:06 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.18.183.211
country_id: 6252001
description:
[2026-06-25 22:16:26 +0000] info [cpaneld] 47.18.183.211 - dig "GET /login/?login_only=1&user=dig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.227.185.86
country_id: 6252001
description:
[2026-06-25 22:18:04 +0000] info [cpaneld] 75.227.185.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.32.49.189
country_id: 6252001
description:
[2026-06-25 22:18:07 +0000] info [cpaneld] 68.32.49.189 - anrtogo "GET /login/?login_only=1&user=anrtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.163.54.71
country_id: 6252001
description:
[2026-06-25 22:18:22 +0000] info [cpaneld] 71.163.54.71 - anrt "GET /login/?login_only=1&user=anrt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.18.66.133
country_id: 6252001
description:
[2026-06-25 22:18:31 +0000] info [cpaneld] 38.18.66.133 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.59.46.156
country_id: 6252001
description:
[2026-06-25 22:18:25 +0000] info [cpaneld] 38.59.46.156 - anr "GET /login/?login_only=1&user=anr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.197.138.32
country_id: 6252001
description:
[2026-06-25 22:18:48 +0000] info [cpaneld] 142.197.138.32 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.82.245.132
country_id: 6252001
description:
[2026-06-25 22:19:00 +0000] info [cpaneld] 72.82.245.132 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.2.121.116
country_id: 6252001
description:
[2026-06-25 22:19:06 +0000] info [cpaneld] 108.2.121.116 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.4.126.160
country_id: 6252001
description:
[2026-06-25 22:20:42 +0000] info [cpaneld] 68.4.126.160 - soroub "GET /login/?login_only=1&user=soroub&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroub (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.85.121
country_id: 6252001
description:
[2026-06-25 22:20:45 +0000] info [cpaneld] 98.113.85.121 - sorou "GET /login/?login_only=1&user=sorou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorou (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.29.169.160
country_id: 3017382
description:
Jun 25 22:20:50 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.29.169.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.0.63.5
country_id: 6252001
description:
[2026-06-25 22:20:48 +0000] info [cpaneld] 73.0.63.5 - soro "GET /login/?login_only=1&user=soro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soro (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 22:21:37 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.216.113
country_id: 6252001
description:
[2026-06-25 22:22:12 +0000] info [cpaneld] 172.59.216.113 - amea "GET /login/?login_only=1&user=amea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.224.91
country_id: 6252001
description:
[2026-06-25 22:22:55 +0000] info [cpaneld] 24.61.224.91 - lagorain "GET /login/?login_only=1&user=lagorain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.101.10
country_id: 6252001
description:
[2026-06-25 22:23:03 +0000] info [cpaneld] 67.181.101.10 - lagora "GET /login/?login_only=1&user=lagora&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagora (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.216.185.145
country_id: 6252001
description:
[2026-06-25 22:23:15 +0000] info [cpaneld] 98.216.185.145 - lag "GET /login/?login_only=1&user=lag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.40.125.233
country_id: 6252001
description:
[2026-06-25 22:23:07 +0000] info [cpaneld] 70.40.125.233 - lagor "GET /login/?login_only=1&user=lagor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.15.172.106
country_id: 6252001
description:
[2026-06-25 22:23:10 +0000] info [cpaneld] 8.15.172.106 - lago "GET /login/?login_only=1&user=lago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.28.68
country_id: 1733045
description:
[2026-06-25 22:26:20 +0000] info [cpaneld] 115.135.28.68 - fo "GET /login/?login_only=1&user=fo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.191.224.8
country_id: 3996063
description:
[2026-06-25 22:26:02 +0000] info [cpaneld] 189.191.224.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.246.25
country_id: 1282988
description:
[2026-06-25 22:26:12 +0000] info [cpaneld] 103.225.246.25 - fomd "GET /login/?login_only=1&user=fomd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.120.74.193
country_id: 3469034
description:
[2026-06-25 22:26:15 +0000] info [cpaneld] 189.120.74.193 - fom "GET /login/?login_only=1&user=fom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fom (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.164.173.20
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 104.164.173.20: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.102.155.209
country_id: 2635167
description:
81.102.155.209 - - [25/Jun/2026:22:26:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790575&pdata=https%253A%252F%252Fwebmail.ccit.tg%252F%253Flocale%253Dfr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782426409 HTTP/2.0" 302 0 webmail.ccit.tg "https://webmail.ccit.tg/?locale=fr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.102.155.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 25 22:26:51 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.155.230.40
country_id: 6252001
description:
[2026-06-25 22:28:15 +0000] info [cpaneld] 24.155.230.40 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.197.49.255
country_id: 6252001
description:
[2026-06-25 22:27:52 +0000] info [cpaneld] 68.197.49.255 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.98.190
country_id: 6252001
description:
[2026-06-25 22:28:02 +0000] info [cpaneld] 98.113.98.190 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.62.152
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-27.104.207.62.152||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.215.82.45
country_id: 6252001
description:
[2026-06-25 22:27:40 +0000] info [cpaneld] 75.215.82.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.36.62
country_id: 6252001
description:
[2026-06-25 22:27:43 +0000] info [cpaneld] 172.59.36.62 - togocarrierebetons "GET /login/?login_only=1&user=togocarrierebetons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.25.204.188
country_id: 6252001
description:
[2026-06-25 22:28:59 +0000] info [cpaneld] 73.25.204.188 - caseafriquetg "GET /login/?login_only=1&user=caseafriquetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseafriquetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.14.79.243
country_id: 6252001
description:
[2026-06-25 22:29:05 +0000] info [cpaneld] 100.14.79.243 - caseafr "GET /login/?login_only=1&user=caseafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.60.210.147
country_id: 6252001
description:
[2026-06-25 22:29:15 +0000] info [cpaneld] 65.60.210.147 - case "GET /login/?login_only=1&user=case&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user case (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [25/Jun/2026:22:28:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737582&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782426515 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [25/Jun/2026:22:28:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987268&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782426517 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.108.169.63
country_id: 6252001
description:
[2026-06-25 22:28:50 +0000] info [cpaneld] 73.108.169.63 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.88.155.206
country_id: 6252001
description:
[2026-06-25 22:29:09 +0000] info [cpaneld] 24.88.155.206 - caseaf "GET /login/?login_only=1&user=caseaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseaf (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [25/Jun/2026:22:28:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196124&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782426516 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.214
country_id: 6290252
description:
Jun 25 22:29:00 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.131.23.152
country_id: 6252001
description:
[2026-06-25 22:29:50 +0000] info [cpaneld] 75.131.23.152 - fomdatg "GET /login/?login_only=1&user=fomdatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomdatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.200.184
country_id: 6252001
description:
[2026-06-25 22:29:54 +0000] info [cpaneld] 73.2.200.184 - fomd "GET /login/?login_only=1&user=fomd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.211.101
country_id: 6252001
description:
[2026-06-25 22:30:00 +0000] info [cpaneld] 108.53.211.101 - fo "GET /login/?login_only=1&user=fo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.32.25
country_id: 3895114
description:
[2026-06-25 22:31:12 +0000] info [cpaneld] 181.43.32.25 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.154.28.139
country_id: 3658394
description:
[2026-06-25 22:31:19 +0000] info [cpaneld] 190.154.28.139 - caissede "GET /login/?login_only=1&user=caissede&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissede (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.108.183.230
country_id: 3469034
description:
[2026-06-25 22:31:20 +0000] info [cpaneld] 200.108.183.230 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.57.207.177
country_id: 3686110
description:
[2026-06-25 22:31:21 +0000] info [cpaneld] 176.57.207.177 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 133.88.123.11
country_id: 1861060
description:
Jun 25 22:30:28 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 133.88.123.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.3.224.25
country_id: 1562822
description:
[2026-06-25 22:31:13 +0000] info [cpaneld] 27.3.224.25 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.217.185.18
country_id: 2017370
description:
[2026-06-25 22:31:35 +0000] info [cpaneld] 62.217.185.18 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.78.142
country_id: 6252001
description:
[2026-06-25 22:31:59 +0000] info [cpaneld] 172.56.78.142 - auditeccandco "GET /login/?login_only=1&user=auditeccandco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.196.120
country_id: 6252001
description:
[2026-06-25 22:32:22 +0000] info [cpaneld] 172.59.196.120 - audi "GET /login/?login_only=1&user=audi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.202.34
country_id: 3658394
description:
[2026-06-25 22:31:27 +0000] info [cpaneld] 181.78.202.34 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.41.181.198
country_id: 298795
description:
[2026-06-25 22:31:48 +0000] info [cpaneld] 176.41.181.198 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.254.154.207
country_id: 6252001
description:
[2026-06-25 22:31:56 +0000] info [cpaneld] 65.254.154.207 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.104.59.104
country_id: 6252001
description:
[2026-06-25 22:32:10 +0000] info [cpaneld] 208.104.59.104 - auditec "GET /login/?login_only=1&user=auditec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.174.149.105
country_id: 3865483
description:
[2026-06-25 22:31:38 +0000] info [cpaneld] 45.174.149.105 - letab "GET /login/?login_only=1&user=letab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.39.227.103
country_id: 690791
description:
[2026-06-25 22:31:29 +0000] info [cpaneld] 194.39.227.103 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.132.49.228
country_id: 3865483
description:
[2026-06-25 22:31:33 +0000] info [cpaneld] 186.132.49.228 - cai "GET /login/?login_only=1&user=cai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.55.207.197
country_id: 6252001
description:
[2026-06-25 22:32:30 +0000] info [cpaneld] 174.55.207.197 - au "GET /login/?login_only=1&user=au&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user au (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.15.157.212
country_id: 798544
description:
Jun 25 22:33:55 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.15.157.212 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 146.59.0.94
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 146.59.0.94: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.182
country_id: 1880251
description:
43.172.197.182 - - [25/Jun/2026:22:35:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713958&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F43800&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782426951 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/43800" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.34.64
country_id: 3865483
description:
Jun 25 22:36:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.34.64 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.137
country_id: 2921044
description:
185.220.101.137 - gsizyncj [25/Jun/2026:22:37:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079703&pdata=https%253A%252F%252Fortouche.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782427058 HTTP/2.0" 302 0 ortouche.com "https://ortouche.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.137


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.228.95.251
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 35.228.95.251: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 25 22:38:03 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.106.124.113
country_id: 783754
description:
[2026-06-25 22:39:13 +0000] info [cpaneld] 79.106.124.113 - togodailynewstg "GET /login/?login_only=1&user=togodailynewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.11.238.173
country_id: 3469034
description:
[2026-06-25 22:39:17 +0000] info [cpaneld] 191.11.238.173 - togodail "GET /login/?login_only=1&user=togodail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.210.90.26
country_id: 3508796
description:
[2026-06-25 22:39:07 +0000] info [cpaneld] 38.210.90.26 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.7.208.80
country_id: 3469034
description:
[2026-06-25 22:39:10 +0000] info [cpaneld] 191.7.208.80 - togodailynews "GET /login/?login_only=1&user=togodailynews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynews (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 22:39:45 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.181.143.249
country_id: 1562822
description:
[2026-06-25 22:39:24 +0000] info [cpaneld] 14.181.143.249 - togoda "GET /login/?login_only=1&user=togoda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoda (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.234.175
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:45.147.234.175||TA:45.147.234.175||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.242.199
country_id: 1668284
description:
2026-06-25 22:39:24 dovecot_plain authenticator failed for H=(ot5mqbxbnou9nn3z8r7oirjjsj0x6x74) [103.156.242.199]:48998: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.4.238
country_id: 3469034
description:
[2026-06-25 22:39:39 +0000] info [cpaneld] 131.196.4.238 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.123.42.181
country_id: 732800
description:
[2026-06-25 22:39:35 +0000] info [cpaneld] 93.123.42.181 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.111.170
country_id: 3932488
description:
[2026-06-25 22:39:32 +0000] info [cpaneld] 38.43.111.170 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.251.218.150
country_id: 2921044
description:
[2026-06-25 22:40:58 +0000] info [cpaneld] 79.251.218.150 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.252.68.82
country_id: 2017370
description:
[2026-06-25 22:41:21 +0000] info [cpaneld] 84.252.68.82 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.23.102.121
country_id: 6252001
description:
[2026-06-25 22:40:55 +0000] info [cpaneld] 24.23.102.121 - tont "GET /login/?login_only=1&user=tont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.226.174.78
country_id: 3996063
description:
[2026-06-25 22:41:01 +0000] info [cpaneld] 177.226.174.78 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.202.157.112
country_id: 6252001
description:
[2026-06-25 22:40:51 +0000] info [cpaneld] 97.202.157.112 - tonto "GET /login/?login_only=1&user=tonto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tonto (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.32.76.143
country_id: 2921044
domain: mail.batika.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.41.251
country_id: 6252001
description:
[2026-06-25 22:40:45 +0000] info [cpaneld] 172.56.41.251 - tontone "GET /login/?login_only=1&user=tontone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.190.29
country_id: 3686110
description:
[2026-06-25 22:41:13 +0000] info [cpaneld] 45.181.190.29 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.139.233.167
country_id: 2017370
description:
[2026-06-25 22:41:05 +0000] info [cpaneld] 95.139.233.167 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.152.81.199
country_id: 3658394
description:
[2026-06-25 22:41:08 +0000] info [cpaneld] 190.152.81.199 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.114.101.74
country_id: 3865483
description:
[2026-06-25 22:41:18 +0000] info [cpaneld] 200.114.101.74 - togome "GET /login/?login_only=1&user=togome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togome (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.32.76.143
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 34.32.76.143: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.62.153
country_id: 6252001
description:
[2026-06-25 22:40:59 +0000] info [cpaneld] 104.203.62.153 - ton "GET /login/?login_only=1&user=ton&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ton (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.65.133
country_id: 6252001
description:
[2026-06-25 22:41:02 +0000] info [cpaneld] 68.45.65.133 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.192.36.94
country_id: 6252001
description:
[2026-06-25 22:40:40 +0000] info [cpaneld] 98.192.36.94 - tontonedouardtogocom "GET /login/?login_only=1&user=tontonedouardtogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedouardtogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.172.105.253
country_id: 6252001
description:
[2026-06-25 22:40:37 +0000] info [cpaneld] 70.172.105.253 - tontonedouardtogo "GET /login/?login_only=1&user=tontonedouardtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedouardtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.68.201.51
country_id: 2542007
description:
[2026-06-25 22:41:25 +0000] info [cpaneld] 105.68.201.51 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.232.234.61
country_id: 6252001
description:
[2026-06-25 22:41:30 +0000] info [cpaneld] 96.232.234.61 - togofarmtg "GET /login/?login_only=1&user=togofarmtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarmtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.212.65
country_id: 6252001
description:
[2026-06-25 22:41:38 +0000] info [cpaneld] 68.7.212.65 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.195.153.205
country_id: 6252001
description:
[2026-06-25 22:41:47 +0000] info [cpaneld] 98.195.153.205 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.38.189.186
country_id: 2635167
description:
Jun 25 22:41:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.38.189.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.10.5.10
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-42.46.10.5.10||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.48.191.2
country_id: 6252001
description:
[2026-06-25 22:41:41 +0000] info [cpaneld] 98.48.191.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.56.29.118
country_id: 6252001
description:
[2026-06-25 22:41:53 +0000] info [cpaneld] 98.56.29.118 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.50.82.166
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 34.50.82.166: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.252.1.6
country_id: 2589581
description:
[2026-06-25 22:41:23 +0000] info [cpaneld] 154.252.1.6 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.44.155.202
country_id: 6252001
description:
[2026-06-25 22:41:25 +0000] info [cpaneld] 174.44.155.202 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.73.6
country_id: 3469034
description:
[2026-06-25 22:41:29 +0000] info [cpaneld] 45.181.73.6 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.38.189.186
country_id: 2635167
description:
2026-06-25 22:41:31 dovecot_plain authenticator failed for H=(17bd5h3f9dgmn7802y3yfmkar) [212.38.189.186]:45934: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.57.127.211
country_id: 6252001
description:
[2026-06-25 22:44:01 +0000] info [cpaneld] 98.57.127.211 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.180.85.8
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 34.180.85.8: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.166.255.10
country_id: 6252001
description:
[2026-06-25 22:44:12 +0000] info [cpaneld] 67.166.255.10 - delxia "GET /login/?login_only=1&user=delxia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.121.67.4
country_id: 6252001
description:
[2026-06-25 22:44:19 +0000] info [cpaneld] 64.121.67.4 - delxi "GET /login/?login_only=1&user=delxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.163.220.85
country_id: 6252001
description:
[2026-06-25 22:43:42 +0000] info [cpaneld] 98.163.220.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.170.103.246
country_id: 3996063
description:
[2026-06-25 22:44:17 +0000] info [cpaneld] 187.170.103.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.233.107.235
country_id: 3469034
description:
[2026-06-25 22:44:20 +0000] info [cpaneld] 45.233.107.235 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.27.247
country_id: 3865483
domain: crepsad.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/crepsad.tg/category/slideshow/page/3/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.48.81.67
country_id: 6252001
description:
[2026-06-25 22:44:11 +0000] info [cpaneld] 174.48.81.67 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.11.65.51
country_id: 6252001
description:
[2026-06-25 22:45:20 +0000] info [cpaneld] 107.11.65.51 - der "GET /login/?login_only=1&user=der&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user der (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.62.145.233
country_id: 99237
description:
[2026-06-25 22:44:40 +0000] info [cpaneld] 5.62.145.233 - funda "GET /login/?login_only=1&user=funda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user funda (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.176.162.128
country_id: 3895114
description:
Denial of Service (DoS) attack was discovered from 34.176.162.128: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.54.4.193
country_id: 102358
description:
[2026-06-25 22:44:24 +0000] info [cpaneld] 188.54.4.193 - fundacionesperanzatogotg "GET /login/?login_only=1&user=fundacionesperanzatogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.161.254
country_id: 6252001
description:
[2026-06-25 22:44:32 +0000] info [cpaneld] 172.56.161.254 - del "GET /login/?login_only=1&user=del&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user del (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.161.147
country_id: 3469034
description:
[2026-06-25 22:44:34 +0000] info [cpaneld] 45.236.161.147 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.80.54.205
country_id: 3686110
description:
[2026-06-25 22:44:37 +0000] info [cpaneld] 186.80.54.205 - fundac "GET /login/?login_only=1&user=fundac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.70.51
country_id: 3469034
description:
[2026-06-25 22:44:44 +0000] info [cpaneld] 45.172.70.51 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.219.170.82
country_id: 953987
description:
[2026-06-25 22:44:50 +0000] info [cpaneld] 102.219.170.82 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.244.144.212
country_id: 3996063
description:
[2026-06-25 22:44:55 +0000] info [cpaneld] 189.244.144.212 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.83.145.142
country_id: 3895114
description:
[2026-06-25 22:44:29 +0000] info [cpaneld] 200.83.145.142 - fundacio "GET /login/?login_only=1&user=fundacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.66.75.128
country_id: 6252001
description:
[2026-06-25 22:45:13 +0000] info [cpaneld] 72.66.75.128 - deroutg "GET /login/?login_only=1&user=deroutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deroutg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.135.232.103
country_id: 6252001
description:
[2026-06-25 22:44:23 +0000] info [cpaneld] 57.135.232.103 - delx "GET /login/?login_only=1&user=delx&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delx (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.6.182
country_id: 6252001
description:
[2026-06-25 22:44:36 +0000] info [cpaneld] 174.182.6.182 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.27.68.153
country_id: 6252001
description:
[2026-06-25 22:45:09 +0000] info [cpaneld] 69.27.68.153 - derou "GET /login/?login_only=1&user=derou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user derou (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 25 22:47:19 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.249.2.185
country_id: 6252001
description:
[2026-06-25 22:47:40 +0000] info [cpaneld] 75.249.2.185 - djam "GET /login/?login_only=1&user=djam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.152.157.188
country_id: 3175395
description:
2026-06-25 22:47:47 dovecot_plain authenticator failed for H=(37knytuw8kg8n6hqco5a) [5.152.157.188]:51055: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.71.18.173
country_id: 6252001
description:
[2026-06-25 22:47:43 +0000] info [cpaneld] 174.71.18.173 - dja "GET /login/?login_only=1&user=dja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dja (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.152.157.188
country_id: 3175395
description:
Jun 25 22:47:45 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.152.157.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.200.14.47
country_id: 6252001
description:
[2026-06-25 22:48:02 +0000] info [cpaneld] 47.200.14.47 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.186.2.244
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.186.2.244: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.185.241.93
country_id: 6252001
description:
[2026-06-25 22:47:31 +0000] info [cpaneld] 47.185.241.93 - djama "GET /login/?login_only=1&user=djama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.77.154.207
country_id: 6252001
description:
[2026-06-25 22:49:21 +0000] info [cpaneld] 173.77.154.207 - sncomtg "GET /login/?login_only=1&user=sncomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncomtg (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.237.173
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-48.168.196.237.173||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.122.4
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-48.138.219.122.4||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.5.136
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-48.138.59.5.136||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.255.221.17
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.255.221.17: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.71.127.15
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-48.200.71.127.15||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.237
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.168.196.238.237||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 168.196.238.42
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:168.196.238.42||TA:168.196.238.42||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.118.199.73
country_id: 6252001
description:
[2026-06-25 22:49:25 +0000] info [cpaneld] 208.118.199.73 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.65.43
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.152.232.65.43||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.101.213
country_id: 6252001
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:161.123.101.213||TA:161.123.101.213||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.76.42.32
country_id: 6252001
description:
[2026-06-25 22:49:29 +0000] info [cpaneld] 66.76.42.32 - snc "GET /login/?login_only=1&user=snc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snc (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.66.162
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.152.232.66.162||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.5.15
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.138.59.5.15||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.68.75
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-50.152.232.68.75||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 25 22:49:22 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.167.42.92
country_id: 6252001
description:
[2026-06-25 22:49:32 +0000] info [cpaneld] 74.167.42.92 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.165.186.9
country_id: 6252001
description:
[2026-06-25 22:50:36 +0000] info [cpaneld] 97.165.186.9 - hotelya "GET /login/?login_only=1&user=hotelya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.74.118
country_id: 6252001
description:
[2026-06-25 22:50:47 +0000] info [cpaneld] 172.56.74.118 - hot "GET /login/?login_only=1&user=hot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.52.52.228
country_id: 6252001
description:
[2026-06-25 22:51:02 +0000] info [cpaneld] 108.52.52.228 - togoagr "GET /login/?login_only=1&user=togoagr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.245.46.113
country_id: 6252001
description:
[2026-06-25 22:51:15 +0000] info [cpaneld] 97.245.46.113 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.101.125.61
country_id: 6252001
description:
[2026-06-25 22:51:18 +0000] info [cpaneld] 74.101.125.61 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.187.191
country_id: 6252001
description:
[2026-06-25 22:50:33 +0000] info [cpaneld] 184.179.187.191 - hotelyab "GET /login/?login_only=1&user=hotelyab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelyab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.50.67.115
country_id: 6252001
description:
[2026-06-25 22:50:42 +0000] info [cpaneld] 136.50.67.115 - hotel "GET /login/?login_only=1&user=hotel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.217.86.62
country_id: 6252001
description:
[2026-06-25 22:50:58 +0000] info [cpaneld] 72.217.86.62 - togoagro "GET /login/?login_only=1&user=togoagro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.126.15.106
country_id: 6252001
description:
[2026-06-25 22:50:30 +0000] info [cpaneld] 24.126.15.106 - hotelyabissocom "GET /login/?login_only=1&user=hotelyabissocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelyabissocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.197.100.248
country_id: 6252001
description:
[2026-06-25 22:50:47 +0000] info [cpaneld] 47.197.100.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.183.133.165
country_id: 6252001
description:
[2026-06-25 22:51:23 +0000] info [cpaneld] 184.183.133.165 - ese2itg "GET /login/?login_only=1&user=ese2itg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2itg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.21
country_id: 1880251
description:
43.173.182.21 - - [25/Jun/2026:22:52:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723430&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F36887&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782427922 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/36887" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.21


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.190.219
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:38.154.190.219||TA:38.154.190.219||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.49.150.248
country_id: 6252001
description:
[2026-06-25 22:51:26 +0000] info [cpaneld] 173.49.150.248 - ese2 "GET /login/?login_only=1&user=ese2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.100.22
country_id: 6252001
description:
[2026-06-25 22:51:29 +0000] info [cpaneld] 73.205.100.22 - ese "GET /login/?login_only=1&user=ese&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.47.195.19
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 34.47.195.19: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 22:52:55 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.103.161.249
country_id: 6252001
description:
[2026-06-25 22:53:43 +0000] info [cpaneld] 74.103.161.249 - social "GET /login/?login_only=1&user=social&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user social (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.68.206.25
country_id: 2510769
description:
[2026-06-25 22:54:22 +0000] info [cpaneld] 90.68.206.25 - atms "GET /login/?login_only=1&user=atms&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atms (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.224.119.111
country_id: 6252001
description:
[2026-06-25 22:53:33 +0000] info [cpaneld] 97.224.119.111 - socialinfostg "GET /login/?login_only=1&user=socialinfostg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialinfostg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.243.3.159
country_id: 6252001
description:
[2026-06-25 22:53:51 +0000] info [cpaneld] 75.243.3.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.244.142.10
country_id: 6252001
description:
[2026-06-25 22:53:54 +0000] info [cpaneld] 98.244.142.10 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.228.118.227
country_id: 3469034
description:
[2026-06-25 22:54:20 +0000] info [cpaneld] 168.228.118.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.60.129.240
country_id: 6252001
description:
[2026-06-25 22:53:56 +0000] info [cpaneld] 139.60.129.240 - matosshop "GET /login/?login_only=1&user=matosshop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matosshop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.28.27.233
country_id: 6252001
description:
[2026-06-25 22:54:10 +0000] info [cpaneld] 138.28.27.233 - matoss "GET /login/?login_only=1&user=matoss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matoss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.75.81.231
country_id: 3508796
description:
[2026-06-25 22:54:25 +0000] info [cpaneld] 38.75.81.231 - atmstg "GET /login/?login_only=1&user=atmstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atmstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.8.45.206
country_id: 6254930
description:
[2026-06-25 22:54:29 +0000] info [cpaneld] 37.8.45.206 - atm "GET /login/?login_only=1&user=atm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.2.126
country_id: 3895114
description:
[2026-06-25 22:55:27 +0000] info [cpaneld] 45.4.2.126 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.168.57
country_id: 2921044
description:
[2026-06-25 22:55:47 +0000] info [cpaneld] 92.208.168.57 - anr "GET /login/?login_only=1&user=anr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.47.148.1
country_id: 1282988
description:
[2026-06-25 22:55:38 +0000] info [cpaneld] 163.47.148.1 - anrtog "GET /login/?login_only=1&user=anrtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
country_id: 1835841
description:
Jun 25 22:56:05 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.180.196.190
country_id: 1605651
description:
[2026-06-25 22:55:42 +0000] info [cpaneld] 180.180.196.190 - anrto "GET /login/?login_only=1&user=anrto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrto (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 176.126.111.217
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:cletachiles6||Email:cleta.cleta@peduzu.mailbox10.info||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.232.128.11
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/delestages-electriques-a-lome-leconomie-sous-tension/<script async src=||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.234.211.118
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 35.234.211.118: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 176.126.111.217
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.20||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.124.63.89
country_id: 6252001
description:
[2026-06-25 22:58:55 +0000] info [cpaneld] 147.124.63.89 - fbafri "GET /login/?login_only=1&user=fbafri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.44.6.109
country_id: 6252001
description:
[2026-06-25 22:59:03 +0000] info [cpaneld] 24.44.6.109 - lasnbtg "GET /login/?login_only=1&user=lasnbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.228.167.121
country_id: 6252001
description:
[2026-06-25 22:59:16 +0000] info [cpaneld] 73.228.167.121 - bawasongroupcom "GET /login/?login_only=1&user=bawasongroupcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroupcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.197.220
country_id: 6252001
description:
[2026-06-25 22:58:49 +0000] info [cpaneld] 71.38.197.220 - fbafricacom "GET /login/?login_only=1&user=fbafricacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafricacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.98.185.15
country_id: 6252001
description:
[2026-06-25 22:58:59 +0000] info [cpaneld] 74.98.185.15 - fbafr "GET /login/?login_only=1&user=fbafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.16.180.145
country_id: 6252001
description:
[2026-06-25 22:59:10 +0000] info [cpaneld] 100.16.180.145 - fb "GET /login/?login_only=1&user=fb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.136.84
country_id: 6252001
description:
[2026-06-25 22:59:19 +0000] info [cpaneld] 38.62.136.84 - bawasong "GET /login/?login_only=1&user=bawasong&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasong (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 25 22:58:27 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.187.36.1
country_id: 6252001
description:
[2026-06-25 22:59:08 +0000] info [cpaneld] 24.187.36.1 - lasn "GET /login/?login_only=1&user=lasn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.111.118.239
country_id: 6252001
description:
[2026-06-25 22:59:23 +0000] info [cpaneld] 76.111.118.239 - bawason "GET /login/?login_only=1&user=bawason&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawason (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.40.241.130
country_id: 6252001
description:
[2026-06-25 22:59:37 +0000] info [cpaneld] 50.40.241.130 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 35.240.159.251
country_id: 1880251
domain: mail.anadeb.free.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/project/.git/config||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.0.99
country_id: 6252001
description:
[2026-06-25 22:59:28 +0000] info [cpaneld] 172.58.0.99 - bawas "GET /login/?login_only=1&user=bawas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawas (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.19.224.51
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 34.19.224.51: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.234.166.2
country_id: 6252001
description:
[2026-06-25 23:02:43 +0000] info [cpaneld] 71.234.166.2 - dkf "GET /login/?login_only=1&user=dkf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.250.128.35
country_id: 6252001
description:
[2026-06-25 23:02:40 +0000] info [cpaneld] 69.250.128.35 - dkfo "GET /login/?login_only=1&user=dkfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.247.12.183
country_id: 6252001
description:
[2026-06-25 23:02:31 +0000] info [cpaneld] 69.247.12.183 - dkfood "GET /login/?login_only=1&user=dkfood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfood (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.12.233.105
country_id: 6252001
description:
[2026-06-25 23:02:46 +0000] info [cpaneld] 108.12.233.105 - dk "GET /login/?login_only=1&user=dk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dk (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.130.86.104
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 34.130.86.104: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.54
country_id: 6252001
description:
205.169.39.54 - - [25/Jun/2026:23:03:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199722&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428598 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.54


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.198.23.197
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/129.0.0.0 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [25/Jun/2026:23:03:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989782&pdata=https%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428602 HTTP/2.0" 302 0 154.70.82.249 "https://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [25/Jun/2026:23:03:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920394&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428603 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.54
country_id: 6252001
description:
205.169.39.54 - - [25/Jun/2026:23:03:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790856&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428600 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.54


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.38.62.109
country_id: 3469034
description:
[2026-06-25 23:04:24 +0000] info [cpaneld] 187.38.62.109 - ucoangers "GET /login/?login_only=1&user=ucoangers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangers (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.32.1
country_id: 1880251
description:
47.128.32.1 - - [25/Jun/2026:23:04:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000235&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428665 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.32.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.39.172.247
country_id: 285570
description:
[2026-06-25 23:04:29 +0000] info [cpaneld] 37.39.172.247 - ucoanger "GET /login/?login_only=1&user=ucoanger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoanger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.28.252.189
country_id: 248816
description:
[2026-06-25 23:04:32 +0000] info [cpaneld] 176.28.252.189 - ucoange "GET /login/?login_only=1&user=ucoange&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoange (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.145.220.205
country_id: 2542007
description:
[2026-06-25 23:04:42 +0000] info [cpaneld] 197.145.220.205 - uco "GET /login/?login_only=1&user=uco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.145.89
country_id: 294640
description:
[2026-06-25 23:04:26 +0000] info [cpaneld] 79.177.145.89 - ucoangerstg "GET /login/?login_only=1&user=ucoangerstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangerstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.57.214.73
country_id: 3865483
description:
[2026-06-25 23:04:40 +0000] info [cpaneld] 190.57.214.73 - ucoa "GET /login/?login_only=1&user=ucoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.166.73.208
country_id: 6252001
description:
[2026-06-25 23:06:04 +0000] info [cpaneld] 174.166.73.208 - sc "GET /login/?login_only=1&user=sc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sc (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.47.8.54
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 34.47.8.54: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.185.141.135
country_id: 6252001
description:
[2026-06-25 23:05:35 +0000] info [cpaneld] 98.185.141.135 - scafricaplccom "GET /login/?login_only=1&user=scafricaplccom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafricaplccom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.234.177.90
country_id: 6252001
description:
[2026-06-25 23:05:39 +0000] info [cpaneld] 96.234.177.90 - scafrica "GET /login/?login_only=1&user=scafrica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafrica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.197.232
country_id: 6252001
description:
[2026-06-25 23:05:48 +0000] info [cpaneld] 172.56.197.232 - scafri "GET /login/?login_only=1&user=scafri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.38.90.65
country_id: 6252001
description:
[2026-06-25 23:05:55 +0000] info [cpaneld] 100.38.90.65 - scaf "GET /login/?login_only=1&user=scaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scaf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.184.190.241
country_id: 6252001
description:
[2026-06-25 23:05:59 +0000] info [cpaneld] 64.184.190.241 - sca "GET /login/?login_only=1&user=sca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.185.106.164
country_id: 6252001
description:
[2026-06-25 23:05:32 +0000] info [cpaneld] 67.185.106.164 - scafricaplc "GET /login/?login_only=1&user=scafricaplc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafricaplc (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.118.41.27
country_id: 798544
description:
Denial of Service (DoS) attack was discovered from 34.118.41.27: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [25/Jun/2026:23:07:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947595&pdata=http%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428829 HTTP/1.1" 302 0 ruralinfos.tg "http://ruralinfos.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 23:07:18 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [25/Jun/2026:23:07:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973546&pdata=http%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428829 HTTP/1.1" 302 0 ruralinfos.tg "http://ruralinfos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.159.18
country_id: 294640
description:
[2026-06-25 23:08:08 +0000] info [cpaneld] 79.177.159.18 - aler "GET /login/?login_only=1&user=aler&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aler (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.38.75.213
country_id: 3469034
description:
[2026-06-25 23:08:13 +0000] info [cpaneld] 177.38.75.213 - ale "GET /login/?login_only=1&user=ale&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ale (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.135.217.149
country_id: 1327865
description:
[2026-06-25 23:08:17 +0000] info [cpaneld] 103.135.217.149 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.76.200.242
country_id: 1562822
description:
[2026-06-25 23:07:56 +0000] info [cpaneld] 115.76.200.242 - alerte "GET /login/?login_only=1&user=alerte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alerte (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-25 23:07:57 +0000] info [cpaneld] 51.83.4.64 NEW ifxmoxbf:O9cGtiD3J7mSNKEu address=51.83.4.64,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.118.164.82
country_id: 6252001
description:
[2026-06-25 23:08:29 +0000] info [cpaneld] 24.118.164.82 - sococimtg "GET /login/?login_only=1&user=sococimtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococimtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.22.193.106
country_id: 6252001
description:
[2026-06-25 23:08:43 +0000] info [cpaneld] 72.22.193.106 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.177.156.191
country_id: 6252001
description:
[2026-06-25 23:08:26 +0000] info [cpaneld] 70.177.156.191 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [25/Jun/2026:23:08:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933190&pdata=https%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782428920 HTTP/2.0" 302 0 ruralinfos.tg "https://ruralinfos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.144.175
country_id: 6252001
description:
[2026-06-25 23:09:57 +0000] info [cpaneld] 104.203.144.175 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.139.248.60
country_id: 6252001
description:
[2026-06-25 23:09:59 +0000] info [cpaneld] 104.139.248.60 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.236.26.8
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.236.26.8: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 25 23:11:56 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.71.111.129
country_id: 6252001
description:
[2026-06-25 23:14:20 +0000] info [cpaneld] 75.71.111.129 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.207.134.155
country_id: 6252001
description:
[2026-06-25 23:13:50 +0000] info [cpaneld] 75.207.134.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.154.154.195
country_id: 3175395
description:
Denial of Service (DoS) attack was discovered from 34.154.154.195: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.192.229.54
country_id: 6252001
description:
[2026-06-25 23:14:06 +0000] info [cpaneld] 24.192.229.54 - togofe "GET /login/?login_only=1&user=togofe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.209.187
country_id: 6252001
description:
[2026-06-25 23:14:08 +0000] info [cpaneld] 153.66.209.187 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.123.64.49
country_id: 6252001
description:
[2026-06-25 23:14:02 +0000] info [cpaneld] 73.123.64.49 - togofee "GET /login/?login_only=1&user=togofee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.82.182.239
country_id: 6252001
description:
[2026-06-25 23:14:49 +0000] info [cpaneld] 64.82.182.239 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.159.94
country_id: 6252001
description:
[2026-06-25 23:15:00 +0000] info [cpaneld] 47.152.159.94 - whiteway "GET /login/?login_only=1&user=whiteway&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whiteway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.118.221.249
country_id: 6252001
description:
[2026-06-25 23:14:53 +0000] info [cpaneld] 172.118.221.249 - whiteways "GET /login/?login_only=1&user=whiteways&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whiteways (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.105.87.51
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.105.87.51: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.102.104.139
country_id: 6252001
domain: mail.formation.free.netmaster.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.20||T:APACHE||MV:.env~||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.102.104.139
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.102.104.139: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.102.104.139
country_id: 6252001
domain: mail.formation.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:formationfreenet||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.29.179.85
country_id: 2017370
description:
[2026-06-25 23:16:29 +0000] info [cpaneld] 31.29.179.85 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.102.104.139
country_id: 6252001
domain: mail.formation.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:formationfreenet||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.138.223.130
country_id: 3469034
description:
[2026-06-25 23:16:35 +0000] info [cpaneld] 200.138.223.130 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.203.76.62
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 35.203.76.62: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.17.8.162
country_id: 2464461
description:
[2026-06-25 23:16:27 +0000] info [cpaneld] 197.17.8.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.63.72.78
country_id: 3865483
description:
[2026-06-25 23:18:29 +0000] info [cpaneld] 179.63.72.78 - ucoangers "GET /login/?login_only=1&user=ucoangers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.213.19.148
country_id: 3469034
description:
[2026-06-25 23:18:33 +0000] info [cpaneld] 181.213.19.148 - ucoangerstg "GET /login/?login_only=1&user=ucoangerstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangerstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.17.224
country_id: 99237
description:
[2026-06-25 23:18:41 +0000] info [cpaneld] 169.224.17.224 - ucoange "GET /login/?login_only=1&user=ucoange&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoange (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.72.84.238
country_id: 3469034
description:
[2026-06-25 23:18:25 +0000] info [cpaneld] 131.72.84.238 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 23:18:57 +0000] info [cpaneld] 102.54.238.57 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.164.151.251
country_id: 1269750
description:
Jun 25 23:18:40 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.164.151.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.219.169
country_id: 3469034
description:
[2026-06-25 23:18:44 +0000] info [cpaneld] 168.196.219.169 - ucoang "GET /login/?login_only=1&user=ucoang&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoang (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 25 23:19:02 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.102.199.24
country_id: 3469034
description:
[2026-06-25 23:18:50 +0000] info [cpaneld] 200.102.199.24 - ucoa "GET /login/?login_only=1&user=ucoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.183.211.81
country_id: 6252001
description:
[2026-06-25 23:20:06 +0000] info [cpaneld] 47.183.211.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.8.113.197
country_id: 3469034
description:
[2026-06-25 23:21:05 +0000] info [cpaneld] 177.8.113.197 - ale "GET /login/?login_only=1&user=ale&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ale (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.165.250.193
country_id: 294640
description:
Denial of Service (DoS) attack was discovered from 34.165.250.193: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.28.245.62
country_id: 690791
description:
[2026-06-25 23:20:43 +0000] info [cpaneld] 31.28.245.62 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.183.6
country_id: 3625428
description:
[2026-06-25 23:20:46 +0000] info [cpaneld] 181.208.183.6 - alerte "GET /login/?login_only=1&user=alerte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alerte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.11.125.235
country_id: 3469034
description:
[2026-06-25 23:20:57 +0000] info [cpaneld] 200.11.125.235 - alert "GET /login/?login_only=1&user=alert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.196.252
country_id: 2542007
description:
[2026-06-25 23:20:59 +0000] info [cpaneld] 105.77.196.252 - aler "GET /login/?login_only=1&user=aler&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aler (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.33.66.203
country_id: 3469034
description:
[2026-06-25 23:20:52 +0000] info [cpaneld] 189.33.66.203 - alertetg "GET /login/?login_only=1&user=alertetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alertetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.25.180
country_id: 6252001
description:
[2026-06-25 23:22:48 +0000] info [cpaneld] 172.56.25.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.54.173.115
country_id: 6252001
description:
[2026-06-25 23:22:55 +0000] info [cpaneld] 73.54.173.115 - droitshu "GET /login/?login_only=1&user=droitshu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.148.82.155
country_id: 6252001
description:
[2026-06-25 23:23:12 +0000] info [cpaneld] 98.148.82.155 - istm "GET /login/?login_only=1&user=istm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.125.28.71
country_id: 6252001
description:
[2026-06-25 23:23:18 +0000] info [cpaneld] 73.125.28.71 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.220.155.60
country_id: 6252001
description:
[2026-06-25 23:23:08 +0000] info [cpaneld] 98.220.155.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.176.229
country_id: 6252001
description:
[2026-06-25 23:23:10 +0000] info [cpaneld] 172.56.176.229 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.2.189.253
country_id: 6252001
description:
[2026-06-25 23:23:14 +0000] info [cpaneld] 173.2.189.253 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.136.35.48
country_id: 6252001
description:
[2026-06-25 23:23:17 +0000] info [cpaneld] 73.136.35.48 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.153.150
country_id: 1562822
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/wp-content/uploads/2023/03/RECRUTEMENT-DU-PERSONNEL-DAPPUI-AUX-PREFECTURES.pdf HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.153.150
country_id: 1562822
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/wp-content/uploads/2023/03/RECRUTEMENT-DU-PERSONNEL-DAPPUI-AUX-PREFECTURES.pdf HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.201.153.106
country_id: 1814991
description:
Jun 25 23:24:00 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.201.153.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.21.229.149
country_id: 6252001
description:
[2026-06-25 23:23:24 +0000] info [cpaneld] 108.21.229.149 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.48.177.153
country_id: 6252001
description:
[2026-06-25 23:23:33 +0000] info [cpaneld] 98.48.177.153 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.155.46.143
country_id: 6252001
description:
[2026-06-25 23:23:33 +0000] info [cpaneld] 47.155.46.143 - soroub "GET /login/?login_only=1&user=soroub&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroub (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.54.200.158
country_id: 6252001
description:
[2026-06-25 23:23:24 +0000] info [cpaneld] 73.54.200.158 - is "GET /login/?login_only=1&user=is&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user is (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.125.43.57
country_id: 6252001
description:
[2026-06-25 23:23:38 +0000] info [cpaneld] 24.125.43.57 - soro "GET /login/?login_only=1&user=soro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.230.84.27
country_id: 6252001
description:
[2026-06-25 23:23:23 +0000] info [cpaneld] 73.230.84.27 - soroubat "GET /login/?login_only=1&user=soroubat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.119.110.129
country_id: 6252001
description:
[2026-06-25 23:23:47 +0000] info [cpaneld] 24.119.110.129 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.156.13.6
country_id: 3686110
description:
Jun 25 23:24:30 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.156.13.6 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.177
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.177: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 23:25:13 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.177
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.177: 181 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.232.87.184
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/synabovito-nouveau-mandat-nouveau-pain-au-togo/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.221.31.145
country_id: 6252001
description:
[2026-06-25 23:25:57 +0000] info [cpaneld] 162.221.31.145 - bela "GET /login/?login_only=1&user=bela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.92.240.201
country_id: 6252001
description:
[2026-06-25 23:26:00 +0000] info [cpaneld] 72.92.240.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.215.88.77
country_id: 6252001
description:
[2026-06-25 23:26:00 +0000] info [cpaneld] 75.215.88.77 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.125.227.18
country_id: 6252001
description:
[2026-06-25 23:25:47 +0000] info [cpaneld] 24.125.227.18 - belali "GET /login/?login_only=1&user=belali&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belali (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.13.181.7
country_id: 6252001
description:
[2026-06-25 23:26:04 +0000] info [cpaneld] 73.13.181.7 - bieredjama "GET /login/?login_only=1&user=bieredjama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredjama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.59.13.31
country_id: 6252001
description:
[2026-06-25 23:25:43 +0000] info [cpaneld] 68.59.13.31 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.10.28.146
country_id: 6252001
description:
[2026-06-25 23:26:08 +0000] info [cpaneld] 100.10.28.146 - bieredjamatg "GET /login/?login_only=1&user=bieredjamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredjamatg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.58.210
country_id: 3017382
description:
Jun 25 23:25:39 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.58.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.255.66.31
country_id: 6252001
description:
[2026-06-25 23:26:11 +0000] info [cpaneld] 68.255.66.31 - bieredja "GET /login/?login_only=1&user=bieredja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredja (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.250.184.202
country_id: 6252001
description:
[2026-06-25 23:26:15 +0000] info [cpaneld] 98.250.184.202 - bieredj "GET /login/?login_only=1&user=bieredj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredj (has_cpuser_file failed)


